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Abstract 



1 Introduction 



The question of whether a problem in a multiagent system that can be solved with a trusted mediator can 
be solved by just the agents in the system, without the mediator, has attracted a great deal of attention in 
both computer science (particularly in the cryptography community) and game theory. In cryptography, 
the focus on the problem has been on secure multiparty computation. Here it is assumed that each 
agent i has some private information x%. Fix functions fi,...,f n . The goal is have agent i learn 
fi(x\, . . . , x n ) without learning anything about Xj for j ^ i beyond what is revealed by the value of 
fi(x±, . . . , x n ). With a trusted mediator, this is trivial: each agent i just gives the mediator its private 
value X{ ; the mediator then sends each agent i the value fi(xi, . . . ,x n ). Work on multiparty computation 
(see [Gol04] for a survey) provides conditions under which this can be done. In game theory, the focus 
has been on whether an equilibrium in a game with a mediator can be implemented using what is called 
cheap talk — that is, just by players communicating among themselves (see [Mye97] for a survey). 

There is a great deal of overlap between the problems studied in computer science and game theory. 
But there are some significant differences. Perhaps the most significant difference is that, in the com- 
puter science literature, the interest has been in doing multiparty computation in the presence of possibly 
malicious adversaries, who do everything they can to subvert the computation. On the other hand, in the 
game theory literature, the assumption is that players have preference and seek to maximize their utility; 
thus, they will subvert the computation iff it is in their best interests to do so. Following [ADGH06], 
we consider here both rational adversaries, who try to maximize their utility, and possibly malicious 
adversaries (who can also be considered rational adversaries whose utilities we do not understand). 

1.1 Our Results 

In this paper we provide new and optimal lower bounds on the ability to implement mediators with 
cheap talk. Recall that a Nash equilibrium a is a tuple of strategies such that given that all other players 
play their corresponding part of a then the best response is also to play a. Given a Nash equilibrium 
a we say that a strategy profile p is a k-punishment strategy for a if, when all but k players play their 
component of p, then no matter what the remaining k players do, their payoff is strictly less than what it 
is with a. We now describe some highlights of our results in the two simplest settings: (1) where rational 
players cannot form coalitions and there are no malicious players (this gives us the solution concept of 
Nash equilibrium) and (2) where there is at most one malicious player. We describe our results in a 
more general setting in Section 1.2. 

No bounded implementations: In [ADGH06] it was shown that any Nash equilibrium with a medi- 
ator for three -player games with a 1 -punishment strategy can be implemented using cheap talk. The 
expected running time of the implementation is constant. It is natural to ask if implementations with 
a bounded number of rounds exist for all three-player games. Theorem 2 shows this is not the case, 
implementations must have infinite executions and cannot be bounded for all three-player games. This 
lower bound highlights the importance of using randomization. An earlier attempt to provide a three- 
player cheap talk implementation [Ben03] uses a bounded implementation, and hence cannot work in 
general. The key insight of the lower bound is that when the implementation is bounded, then at some 
point the punishment strategy must become ineffective. The details turn out to be quite subtle. The only 
other lower bound that we are aware of that has the same flavor is the celebrated FLP result [FLP85] for 
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reaching agreement in asynchronous systems, which also shows that no bounded implementation exists. 
However, we use quite different proof techniques than FLP. 

Byzantine Agreement and Game Theory: We give the first rigorous connection between Byzantine 
agreement lower bounds and lower bounds on implementation. To get the lower bounds, we need to 
consider a number of variants of Byzantine agreement, some novel. The novel variants require new 
impossibility results. We have four results of this flavor: 

1. Barany [Bar92] gives an example to show that, in general, to implement an equilibrium with 
a mediator in a three-player game, it is necessary to have a 1 -punishment strategy. Using the 
power of randomized Byzantine agreement lower bounds we strengthen his result and show in 
Theorem 4 that we cannot even get an e-implementation in this setting. 

2. Using the techniques of [BGW88] or [For90], it is easy to show that any four-player game Nash 
equilibrium with a mediator can be implemented using cheap talk even if no 1 -punishment strat- 
egy exists. Moreover, these implementations are universal; they do not depend on the players' 
utilities. In Theorem 3 we prove that universal implementations do not exist in general for three- 
player games. Our proof uses a nontrivial reduction to the weak Byzantine agreement (WBA) 
problem [Lam83]. To obtain our lower bound, we need to prove a new impossibility result for 
WBA, namely, that no protocol with a finite expected running time can solve WBA. 

3. In [ADGH06] we show that for six-player games with a 2-punishment strategy, any Nash equi- 
librium can be implemented even in the presence of at most one malicious player. In Theorem 5 
we show that for five players even e— implementation is impossible. The proof uses a variant of 
Byzantine agreement; this is related to the problem of broadcast with extended consistency intro- 
duced by Fitzi et al. [FHHW03]. Our reduction maps the rational player to a Byzantine process 
that is afraid of being detected and the malicious player to a standard Byzantine process. 

4. In Theorem 8, we show that for four-player games with at most one malicious player, to implement 
the mediator, we must have a PKI setup in place, even if the players are all computationally 
bounded and even if we are willing to settle for e-implementations. Our lower bound is based on 
a reduction to a novel relaxation of the Byzantine agreement problem. 

Bounds on running time: We provide bounds on the number of rounds needed to implement two- 
player games. In Theorem 9(a) we prove that the expected running time of any implementation of a two- 
player mediator equilibrium must depend on the utilities of the game, even if there is a 1 -punishment 
strategy. This is in contrast to the three -player case, where the expected running time is constant. 
In Theorem 9(b) we prove that the expected running time of any e-implementation of a two-player 
mediator equilibrium for which there is no 1 -punishment strategy must depend on e. Both results are 
obtained using a new two-player variant of the secret-sharing game. The only result that we are aware of 
that has a similar sprit is that of Boneh and Naor [BNOO], where it is shown that two-party protocols with 
"bounded unfairness" of e must have running time that depends on the value of e. The implementations 
given by Urbano and Vila [UV02, UV04] in the two-player case are independent of the utilities; the 
above results show that their implementation cannot be correct in general. 
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1.2 Our results for implementing robust and resistent mediators 

In [ADGH06] (ADGH from now on), we argued that it is important to consider deviations by both 
rational players, who have preferences and try to maximize them, and players that can be viewed as 
malicious, although it is perhaps better to think of them as rational players whose utilities are not known 
by the other players or mechanism designer. We considered equilibria that are (k, t)-robust; roughly 
speaking, this means that the equilibrium tolerates deviations by up to k rational players, whose utilities 
are presumed known, and up to t players with unknown utilities (i.e., possibly malicious players). We 
showed how (k, i)-robust equilibria with mediators could be implemented using cheap talk, by first 
showing that, under appropriate assumptions, we could implement secret sharing in a (k, t)-robust way 
using cheap talk. These assumptions involve standard considerations in the game theory and distributed 
systems literature, specifically, (a) the relationship between k, t and n, the total number of players in 
the system; (b) whether players know the exact utilities of other players; (c) whether there are broadcast 
channels or just point-to-point channels; (d) whether cryptography is available; and (e) whether the 
game has a (k + t) -punishment strategy; that is, a strategy that, if used by all but at most k + t players, 
guarantees that every player gets a worse outcome than they do with the equilibrium strategy. Here we 
provide a complete picture of when implementation is possible, providing lower bounds that match the 
known upper bounds (or improvements of them that we have obtained). The following is a high-level 
picture of the results. (The results discussed in Section 1 . 1 are special cases of the results stated below. 
Note that all the upper bounds mentioned here are either in ADGH, slight improvements of results in 
ADGH, or are known in the literature; see Section 3 for the details. The new results claimed in the 
current submission are the matching lower bounds.) 

• If on > 3k + St, then mediators can be implemented using cheap talk; no punishment strategy 
is required, no knowledge of other agents' utilities is required, and the cheap-talk strategy has 
bounded running time that does not depend on the utilities (Theorem 1(a) in Section 3). 

• If n < 3k + 3t, then we cannot, in general, implement a mediator using cheap talk without knowl- 
edge of other agents' utilities (Theorem 3). Moreover, even if other agents' utilities are known, 
we cannot, in general, implement a mediator without having a punishment strategy (Theorem 4) 
nor with bounded running time (Theorem 2). 

• If n > 2k + 3t, then mediators can be implemented using cheap talk if there is a punishment 
strategy (and utilities are known) in finite expected running time that does not depend on the 
utilities (Theorem 1(b) in Section 3). 

• If n < 2k + 3t, then we cannot, in general, e-implement a mediator using cheap talk, even if there 
is a punishment strategy and utilities are known (Theorem 5). 

• If n > 2k + 2t and we can simulate broadcast then, for all e, we can e-implement a mediator 
using cheap talk, with bounded expected running time that does not depend on the utilities in the 
game or on e (Theorem 1(c) in Section 3). (Intuitively, an e-implementation is an implementation 
where a player can gain at most e by deviating.) 

• If n < 2k + 2t, we cannot, in general, e-implement a mediator using cheap talk even if we 
have broadcast channels (Theorem 7). Moreover, even if we assume cryptography and broadcast 
channels, we cannot, in general, e-implement a mediator using cheap talk with expected running 
time that does not depend on e (Theorem 9(b)); even if there is a punishment strategy, then we 
still cannot, in general, e-implement a mediator using cheap talk with expected running time 
independent of the utilities in the game (Theorem 9(a)). 

• If n > k + 3t then, assuming cryptography, we can e-implement a mediator using cheap talk; 
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moreover, if there is a punishment strategy, the expected running time does not depend on e 
(Theorem 1(e) in Section 3). 

• If n < k + 3t, then even assuming cryptography, we cannot, in general, e-implement a mediator 
using cheap talk (Theorem 8). 

• If n > k + t, then assuming cryptography and that a PKI (Public Key Infrastructure) is in place, 1 
we can e-implement a mediator (Theorem 1(d) in Section 3); moreover, if there is a punishment 
strategy, the expected running time does not depend on e (Theorem 1(e) in Section 3). 

The lower bounds are existential results; they show that if certain conditions do not hold, then there 
exists an equilibrium that can be implemented by a mediator that cannot be implemented using cheap 
talk. There are other games where these conditions do not hold but we can nevertheless implement a 
mediator. 

1.3 Related work 

There has been a great deal of work on implementing mediators, both in computer science and game 
theory. The results above generalize a number of results that appear in the literature. We briefly discuss 
the most relevant work on implementing mediators here. Other work related to this paper is discussed 
where it is relevant. 

In game theory, the study of implementing mediators using cheap talk goes back to Crawford and 
Sobel [CS82]. Barany [Bar92] shows that if n > 4, k = 1, and t = (i.e., the setting for Nash 
equilibrium), a mediator can be implemented in a game where players do not have private information. 
Forges [For90] provides what she calls a universal mechanism for implementing mediators; essentially, 
when combining her results with those of Barany, we get the special case of Theorem 1(a) where k = 1 
and t = 0. Ben-Porath [Ben03] considers implementing a mediator with cheap talk in the case that 
k = 1 if n > 3 and there is a 1 -punishment strategy. He seems to have been the first to consider 
punishment strategies (although his notion is different from ours: he requires that there be an equilibrium 
that is dominated by the equilibrium that we are trying to implement). Heller [Hel05] extends Ben- 
Porath's result to allow arbitrary k. Theorem 1(b) generalizes Ben-Porath and Heller's results. Although 
Theorem 1(b) shows that the statement of Ben-Porath's result is correct, Ben-Porath's implementation 
takes a bounded number of rounds; Theorem 2 shows it cannot be correct. 2 Heller proves a matching 
lower bound; Theorem 5 generalizes Heller's lower bound to the case that t > 0. (This turns out to 
require a much more complicated game than that considered by Heller.) Urbano and Vila [UV02, UV04] 
use cryptography to deal with the case that n = 2 and k = l; 3 Theorem 1(e)) generalizes their result to 
arbitrary k and t. However, just as with Ben-Porath, Urbano and Vila's implementation takes a bounded 
number of rounds; As we said in Section 1.1, Theorem 9(a) shows that it cannot be correct. 

In the cryptography community, results on implementing mediators go back to 1982 (although this 
terminology was not used), in the context of (secure) multiparty computation. Since there are no util- 
ities in this problem, the focus has been on essentially what we call here t-immunity: no group of t 
players can prevent the remaining players from learning the function value, nor can they learn the other 

1 We can replace the assumption of a PKI here and elsewhere by the assumption that there is a trusted preprocessing phase 
where players may broadcast. 

2 Although Heller's implementation does not take a bounded number of rounds, it suffers from problems similar to those of 
Ben-Porath. 

3 However, they make somewhat vague and nonstandard assumptions about the cryptographic tools they use. 
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players' private values. Results of Yao [Yao82] can be viewed as showing that if n = 2 and appropriate 
computational hardness assumptions are made, then, for all e, we can obtain 1 -immunity with probabil- 
ity greater than 1 — e if appropriate computational hardness assumptions hold. Goldreich, Micali, and 
Wigderson [GMW87] extend Yao's result to the case that t > and n > t. Ben-Or, Goldwasser, and 
Wigderson [BGW88] and Chaum, Crepeau, and Damgard [CCD88] show that, without computational 
hardness assumptions, we can get i-immunity if n > 3t; moreover, the protocol of Ben-Or, Goldwasser, 
and Wigderson does not need an e "error" term. Although they did not consider utilities, their protocol 
actually gives a (k, i)-robust implementation of a mediator using cheap talk if n > 3k + 3t; that is, they 
essentially prove Theorem 1(a). (Thus, although these results predate those of Barany and Forges, they 
are actually stronger.) Rabin and Ben-Or [RB89] provide a t-immune implementation of a mediator 
with "error" e if broadcast can be simulated. Again, when we add utilities, their protocol actually gives 
an e-(k, t)-robust implementation. Thus, they essentially prove Theorem 1(c). Dodis, Halevi, and Ra- 
bin [DHROO] seem to have been the first to apply cryptographic techniques to game-theoretic solution 
concepts; they consider the case that n = 2 and k = 1 and there is no private information (in which case 
the equilibrium in the mediator game is a correlated equilibrium [Aum87]); their result is essentially 
that of Urbano and Vila [UV04] (although their protocol does not suffer form the problems of that of 
Urbano and Vila). 

Halpern and Teague [HT04] were perhaps the first to consider the general problem of multiparty 
computation with rational players. In this setting, they essentially prove Theorem 1(d) for the case that 
t = and n > 3. However, their focus is on the solution concept of iterated deletion. They show 
that there is no Nash equilibrium for rational multiparty computation with rational agents that survives 
iterated deletion and give a protocol with finite expected running time that does survive iterated deletion. 
If n < 3(k + t), it follows easily from Theorem 2: that there is no multiparty computation protocol that 
is a Nash equilibrium, we do not have to require that the protocol survive iterated deletion to get the 
result if n < 3(k + t). Various generalizations of the Halpern and Teague results have been proved. 
We have already mentioned the work of ADGH. Lysanskaya and Triandopoulos [LT06] independently 
proved the special case of Theorem 1(c) where k = 1 and t + 1 < n/2 (they also consider survival of 
iterated deletion); Gordon and Katz [GK06] independently proved a special case of Theorem 1(d) where 
k = 1, t = 0, and n > 2. 

In this paper we are interested in implementing equilibrium by using standard communication chan- 
nels. An alternate option is to consider the possibility of simulating equilibrium by using much stronger 
primitives. Izmalkov, Micali, and Lepinski [IML05] show that, if there is a punishment strategy and we 
have available strong primitives that they call envelopes and ballot boxes, we can implement arbitrary 
mediators perfectly (without an e error) in the case that k = 1, in the sense that every equilibrium of 
the game with the mediator corresponds to an equilibrium of the cheap-talk game, and vice versa. In 
[LMPS04, LMS05], these primitives are also used to obtain implementation that is perfectly collusion 
proof in the model where, in the game with the mediator, coalitions cannot communicate. (By way of 
contrast, we allow coalitions to communicate.) Unfortunately, envelopes and ballot boxes cannot be 
implemented under standard computational and systems assumptions [LMS05] . 

It is reasonable to ask at this point whether mediators are of practical interest. After all, if three 
companies negotiate, they can just hire an arguably trusted mediator, say an auditing firm. The dis- 
advantage of this approach in a setting like the internet, with constantly shifting alliances, there are 
always different groups that want to collaborate; a group may not have the time and flexibility of hiring 
a mediator, even assuming they can find one they trust. Another concern is that our results simply shift 
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the role of what has to be trust elsewhere. It is certainly true that our results assume point-to-point 
communication that cannot be intercepted. If n < k + 3t, then we must also assume the existence of 
a public-key infrastructure. Thus, we have essentially shifted from trusting the mediator to trusting the 
PKI. In practice, individuals who want to collaborate may find point-to-point communication and a PKI 
more trustworthy than an intermediary, and easier to work with. 

The rest of this paper is organized as follows. In Section 2, we review the relevant definitions. In 
Section 3, we briefly discuss the upper bounds, and compare them to the results of ADGH. In Section 4, 
we prove the lower bounds. The missing proofs appear in the appendix. 

2 Definitions 

In this section, we give detailed definitions of the main notions needed for our results. Sometimes there 
are subtle differences between our differences and those used in the game-theory literature. We discuss 
these differences carefully. 

2.1 Mediators and cheap talk 

We are interested in implementing mediators. Formally, this means we need to consider three games: an 
underlying game F, an extension Fj of F with a mediator, and a cheap-talk extension Tct of F. Our un- 
derlying games are (normal-form) Bayesian games. These are games of incomplete information, where 
players make only one move, and these moves are made simultaneously. The "incomplete information" 
is captured by assuming that nature makes the first move and chooses for each player i a type in some 
set %, according to some distribution that is commonly known. Formally, a Bayesian game F is defined 
by a tuple (N, T, A, u, p), where N is the set of players, T = x ie j^Ti is the set of possible types, p 
is the distribution on types, A = x ie ^Ai is the set of action profiles, and U{ : T x A is the utility of 
player i as a function of the types prescribed by nature and the actions taken by all players. 

A strategy for player i in a Bayesian game F is a function from i's type to an action in Af, in a 
game with a mediator, a strategy is a function from i's type and message history to an action. We 
allow behavior strategies (i.e., randomized strategies); such a strategy gets an extra argument, which is 
a sequence of coin flips (intuitively, what a player does can depend on its type, the messages it has sent 
and received if we are considering games with mediators, and the outcome of some coin flips). We use 
lower-case Greek letters such as a, r, and p to denote a strategy profile; <jj denotes the strategy of player 
i in strategy profile a; if K C N, then o~k denotes the strategies of the players in K and o~-k denotes 
the strategies of the players not in K. Given a strategy profile a a player i € N and a type 1 1 G T.- t let 
Ui(U, a) be the expected utility of player i given that his type is ti and each player j G N is playing the 
strategy o~j. 

Given an underlying Bayesian game F as above, a game Fj with a mediator d that extends F is, 
informally, a game where players can communicate with the mediator and then perform an action from 
T. The utility function of a player i in Fd is the same as that in F; thus, the utility of a player i in Fj 
depends just on the types of all players and the actions taken by all players. Formally, we view both the 
mediator and the players as interacting Turing machines with access to an unbiased coin (which thus 
allows them to choose uniformly at random from a finite set of any size). The mediator and players 
interact for some (possibly unbounded) number of stages. A mediator is characterized by a function 
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V that maps the inputs it has received up to a stage (and possible some random bits) to an output for 
each player. Given an underlying Bayesian game F where player i's actions come from the set Ai and 
a mediator d, the interaction with the mediator in F^ proceeds in stages, where each stage consists of 
three phases. In the first phase of a stage, each player i sends an input to d (player i can send the empty 
input, i.e., no input at all); in the second phase, d sends each player i an output according to V, (again, 
the mediator can send the empty output); and in the third phase, each player i chooses an action in Ai 
or no action at all. A player can play at most one action from A4 in each execution (play) of Fj. Player 
z's utility function in F^ is the same as that in the underlying game F, and depends only on the action 
profile in A played by the players and the types. To make this precise, we need to define what move 
an action in Ai is played by player i in executions of T^ where i in fact never plays an action in Ai. 
For ease of exposition, we assume that for each player i, some default action a* G A is chosen. There 
are other ways of dealing with this issue (see, for example, [AH03] for an alternative approach). Our 
results do not depend on the choice, since in our upper bounds, with probability 1, all players do play 
an action in equilibrium, and our impossibility results are independent of the action chosen if players 
do not choose an action. (We remark that the question of what happens after an infinite execution of the 
cheap-talk game becomes much more significant in asynchronous systems; see [ADH].) 

Although we think of a cheap-talk game as a game where players can communicate with each other 
(using point-to-point communication and possibly broadcast), formally, it is a game with a special kind 
of mediator: player i send the mediator whatever messages it wants to send other players in the first 
phase of a round; the mediator forwards these messages to the intended recipients in the second phase. 
We can model broadcast messages by just having the mediator tag a message as a broadcast (and sending 
the same message to all the intended recipients, of course). 

We assume that cheap talk games are always unbounded; players are allowed to talk forever. The 
running time of an execution of a joint strategy a is the number of steps taken until the last player makes 
a move in the underlying game. The running time may be infinite. 

It is standard in the game theory literature to view cheap talk as pre-play communication. Thus, al- 
though different plays of r CT may have different running times (possibly depending on random factors), 
it is assumed that it is commonly known when the cheap-talk phase ends; then all players make their 
decisions simultaneously. It is not possible for some players to continue communicating after some 
other players have decided (see, for example, [Hel05], where this assumption is explicit). For their 
possibility results, ADGH define games and give recommended strategies for these games such that, as 
long as players use the recommended strategy, all players make a move at the same time in each play of 
the cheap-talk game. However, it is not assumed that this is the case off the equilibrium path (that is, if 
players do not follow the recommended strategy). The assumption that all players stop communicating 
at the same time seems to us very strong, and not implementable in practice, so we do not make it here. 
(Dropping this assumption sometimes makes our impossibility results harder to prove; see the proof 
of Theorem 7 in Appendix A.5 for an example.) Thus, there is essentially only one cheap-talk game 
extending an underlying game F,; r CT denotes the cheap-talk extension of F. 

When we consider a deviation by a coalition K, we want to allow the players in K to communicate 
with each other. If F' is an extension of an underlying game F (including F itself) and K C N, let 
r' + CT{K) be the extension of F where the mediator provides private cheap-talk channels for the 
players in K in addition to whatever communication there is in F'. Note that T C t + CT(K) is just T C t; 
players in K can already talk to each other in Tct- 
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2.2 Implementation 

Note that a strategy profile — whether it is in the underlying game, or in a game with a mediator ex- 
tending the underlying game (including a cheap-talk game) — induces a mapping from type profiles to 
distributions over action profiles. If Ti and T2 are extension of some underlying game T, then strat- 
egy o\ in Ti implements a strategy 02 in T2 if both a and a' induce the same function from types to 
distributions over actions. Note that although our informal discussion in the introduction talked about 
implementing mediators, the formal definitions (and our theorems) talk about implementing strategies. 
Our upper bounds show that, under appropriate assumptions, for every (k, t)-robust equilibrium a in a 
game Y\ with a mediator, there exists an equilibrium a' in the cheap-talk game 1^ corresponding to Ti 
that implements a; the lower bounds in this paper show that, if these conditions are not met, there exists 
a game with a mediator and an equilibrium in that game that cannot be implemented in the cheap-talk 
game. Since our definition of games with a mediator also allow arbitrary communication among the 
agents, it can also be shown that every equilibrium in a cheap-talk game can be implemented in the 
mediator game: the players simply ignore the mediator and communicate with each other. 

2.3 Solution concepts 

We can now define the solution concepts relevant for this paper. In particular, we consider a number of 
variants of (k, t) robustness, and the motivation behind them. 

In defining these solution concepts, we need to consider the expected utility of s trategy profile 
conditional on players having certain types. We abuse notation and continue to use m for this, writing for 
example, Ui(tx, c) to denote the expected utility to player i if the strategy profile a is used, conditional 
on the players in K having the types tjc- Since the strategy a here can come from the underlying game 
or some extension of it, the function Ui is rather badly overloaded. We sometimes include the relevant 
game as an argument to m to emphasize which game the strategy profile a is taken from, writing, for 
example, Ui(tx, T', a). 

fc-resilient equilibrium: A strategy profile is a Nash equilibrium if no player can gain any advantage 
by using a different strategy, given that all the other players do not change their strategies. We want to 
define a notion of k-resilient equilibrium that generalizes Nash equilibrium, but allows a coalition of up 
to k players to change their strategies. One way of capturing this, which goes back to Aumann [Aum59], 
is to require that there be no deviations that result in everyone in a group of size at most k doing better. 

To make this intuition precise, we need some notation. Given a type space T, a set K of players, 
and t G T, let Titx) = {t ' ■ t ' K = tx}- If T is a game over type space T, a is a strategy profile in T, 
and Pr is the probability on the type space T, let 

Ui {t K ,a)= J2 V?(t' \T{t K )) Ui {t',a). 
t'eT(t K ) 

Thus, Ui(tK, c) is i's expected payoff if everyone uses strategy a and types are restricted to T(i^). 

Definition 1. a is a k -resilient' equilibrium if, for all K C N and all types t G T, it is not the case that 
there exists a strategy r such that Ui(tx,TK, o~-k) > Ui(tK,a) for all i £ K. 
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Thus, a is /c -resilient' if no subset K of at most k players can all do better by deviating, even if they 
share their type information (so that if the true type is t, the players in K know tx)- This is essentially 
Aumman's [Aum59] notion of resilience to coalitions, except that we place a bound on the size of 
coalitions. 

As the prime suggests, this will not be exactly the definition we focus on. ADGH consider a stronger 
notion, which requires that there be no deviation where even one player does better. 

Definition 2. a is a strongly k -resilient' equilibrium if, for all K C N with \K\ < k and all types 
t 6 T, it is not the case that there exists a strategy r such that Ui(tx, t~k, cx_x) > u i(tK, o) for some 
i 6 K. 

Both of these definitions have a weakness: they implicitly assume that the coalition members can- 
not communicate with each other beyond agreeing on what sttategy to use. While, in general, there are 
equilibria in the cheap-talk game that are not available in the underlying game (so having more commu- 
nication can increase the number of possible equilibria), perhaps surprisingly, allowing communication 
between coalition members can also prevent certain equilibria, as the following example shows. 

Example 1. Consider a game with four players. Players 1 and 2 have a type in {0, 1}; the type of 
players 3 and 4 is 0. All tuples of types are equally likely. Players 3 and 4 can each choose an action 
in the set {0, 1, PUNISH, PASS}; players 1 and 2 each choose an action in {punish, PASS}. If anyone 
plays PUNISH, then everyone gets a payoff of —1. If no one plays PUNISH, the payoffs are as follows: 
If player 3 plays PASS, then 3 gets a payoff of 1; similarly, if player 4 plays PASS, then 4 gets a payoff 
of 1. If player 3 plays or 1 and this is l's type, then 3 gets 5; if not, then 3 gets -5; similarly for 
player 4. Finally, if player 2's type is 0, then player 1 and 2's payoffs are the same as player 3's payoffs; 
similarly, if player 2 has a 1, then 1 and 2's payoffs are the same as 4's payoffs. It is easy to see that 
everyone playing PASS is a 3-resilient' equilibrium in the underlying game and it is also an equilibrium 
in the game with a mediator, if the players cannot communicate. However, if players can communicate 
for one round, then players 1, 2, and 3 can do better if player 1 sends player 3 his type, and player 3 
plays it. This guarantees player 3 a payoff of 5, while players 1 and 2 get an expected payoff of 2.5. 

Now suppose that we consider a variant of this game, where the actions are the same and the payoffs 
for players 3 and 4 are the same, but the payoffs for players 1 and 2 are modified as follows. If player 
2's type is 0, then if no one plays PUNISH, player 1 and 2's payoffs are the same as player 3's payoffs if 
player 4 plays PASS; if player 4 plays or 1, then their payoff is —5. Similarly, if player 2's type is 1, 
then player 1 and 2's payoffs are the same player 4's payoffs if player 3 plays PASS; if player 3 plays 
or 1, then their payoff is —5. It is easy to show that everyone playing PASS is still 3-resilient' if we allow 
only one round of communication. But with two rounds of communication, everyone playing PASS is 
no longer 3-resilient': players 1, 2, and 3 can do better if player 2 sends player 1 his type, player 1 sends 
player 3 his type if player 2's type is (and sends nothing otherwise), and player 3 plays player l's type 
if player 1 sends it. □ 

Since it seems reasonable to assume that coalition members will communicate, it seems unreason- 
able to call everyone playing PASS 3-resilient if some communication among coalition members can 
destroy that equilibrium. More generally, we clearly cannot hope to implement a A;-resilient equilibrium 
in the mediator game using cheap talk if the equilibrium does not survive once we allow communication 
among the coalition members. This motivates the following definition. 
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Definition 3. a is a (strongly) A: -resilient equilibrium in a game V if, for all K C N with \K\ <k and 
all types t 6 T, it is not the case that there exists a strategy r such that Ui(tx, T'+CT(K),tk,o~-k) > 
Ui(tK,F' ,a)for some i £ K. 

This definition makes precise the intuition that players in the coalition are allowed arbitrary communi- 
cation among themselves. 

Note that Nash equilibrium is equivalent to both 1 -resilience and strong 1 -resilience; however, the 
notions differ for k > 1. It seems reasonable in many applications to bound the size of coalitions; it 
is hard to coordinate a large coalition! Of course, the appropriate bound on the size of the coalition 
may well depend on the utilities involved. Our interest in strong /^-resilience was motivated by wanting 
to allow situations where one player effectively controls the coalition. This can happen in practice in 
a network if one player can "hijack" a number of nodes in the network. It could also happen if one 
player can threaten others, or does so much better as a result of the deviation that he persuades other 
players to go along, perhaps by the promise of side payments. While it can be argued that, if there 
are side payments or threats, they should be modeled in the utilities of the game, it is sometimes more 
convenient to work directly with strong resilience. In this paper we consider both resilience and strong 
resilience, since the results on implementation obtained using the different notions are incomparable. 
Just because a strongly resilient strategy in a game with a mediator can be implemented by a strongly 
resilient strategy in a cheap-talk game, it does not follow that a resilient strategy with a mediator can be 
implemented by a resilient strategy in a cheap-talk game, or vice versa. However, as we show, we get 
the same lower bounds for both resilience and strong resilience: in our lower bounds, we give games 
with mediators with a strongly A; -resilient equilibrium a and show that there does not exist a cheap-talk 
game and a strategy that a' that implements a and is A; -resilient. Similarly, we can show that we get the 
same upper bounds with both A; -resilience and strong A; -resilience. 

Other notions of resilience to coalitions have been defined in the literature. For example, Bernheim, 
Peleg, and Whinston [BPW89] define a notion of coalition-proof Nash equilibrium that, roughly speak- 
ing, attempts to capture the intuition that a is a coalition-proof equilibrium if there is no deviation that 
allows all players to do better. However, they argue that this is too strong a requirement, in that some 
deviations are not viable: they are not immune from further deviations. Thus, they give a rather compli- 
cated definition that tries to capture the intuition of a deviation that is immune from further deviations. 
This work is extended by Moreno and Wooders [MW96] to allow correlated strategies. Although it is 
beyond the scope of this paper to go through the definitions, it is easy to see that our impossibility results 
apply to them, because of the particular structure of the games we consider. 

For some of our results we will be interested in strategies that give "almost" A; -resilience, in the 
sense that no player in a coalition can do more than e better by deviating, for some small e. 

Definition 4. If e > 0, then a is an e-A>resilient equilibrium in a game V if for all K C N with 
\K\ < k and all types t € T, it is not the case that there exists a strategy r such that Ui^tx,^' + 
CT(K),T K ,a- K ) > Ui(t K ,T',a) + e for alii G K. 

Clearly if e = 0, then an e-k -resilient equilibrium is a A; -resilient equilibrium. 

(A;, t)-robust equilibrium: We now define the main solution concept used in this paper: (A;, t)-robust 
equilibrium. The k indicates the size of coalition we are willing to tolerate, and the t indicates the 
number of players with unknown utilities. These t players are analogues of faulty players or adversaries 
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in the distributed computing literature, but we can think of them as being perfectly rational. Since we do 
not know what actions these t players will perform, nor do we know their identities, we are interested 
in strategies for which the payoffs of the remaining players are immune to what the t players do. 

Definition 5. A strategy profile a in a game T is i-immune if, for all T C N with \T\ < t, all strategy 
profiles t, all i ^ T, and all types t{ G 1% that occur with positive probability, we have Ui(ti,T + 
CT{T),a- T ,T T ) > Ui(ti,T,a). 

Intuitively, a is i-immune if there is nothing that players in a set T of size at most t can do to give 
the remaining players a worse payoff, even if the players in T can communicate. 

Our notion of (k, t)-robustness requires both f-immunity and A; -resilience. In fact, it requires k- 
resilience no matter what up to t players do. That is, we require that no matter what t players do, no 
subset of size at most k can all do better by deviating, even with the help of the t players, and even if all 
k + t players share their type information. 

Definition 6. Given e > 0, a is an e-(k, i)-robust equilibrium in game T if a is t-immune and, for all 
K, T C N such that \K\ < k, \T\ < t, and K f] T = 0, and all types txuT G Tkvjt that occur with 
positive probability, it is not the case that there exists a strategy profile r such that 

Ui(t KuT ,T + CT(K UT),t KuT ,o-_( KuT - ) ) > Ui(U,T + CT(T),t t ,<J-t) + e 

for all i G K. A (k, t)-robust equilibrium is just a 0—(k, t)-robust equilibrium. 

We can define a strongly (k, t) -robust equilibrium by analogy to the definition strongly k -resilient 
equilibrium: we simply change "for all i G K" in the definition of (k, £)-robust equilibrium to "for some 
i G K". Thus, in a strongly (k, £)-robust equilibrium, not even a single agent in K can do better if all 
the players in K deviate, even with the help of the players in T. 

Note that a (1, 0)-robust equilibrium is just a Nash equilibrium, and an e-(l, 0)-robust equilibrium 
is what has been called an e-Nash equilibrium in the literature. A (strongly) (k, 0) -robust equilibrium 
is just a (strongly) A; -resilient equilibrium. The notion (0, t)-robustness is somewhat in the spirit of 
Eliaz's [EH02] notion of t fault-tolerant implementation. Both our notion of (0, i)-robustness and Eliaz's 
notion of t-fault tolerance require that what the players not in T do is a best response to whatever the 
players in T do (given that all the players not in T follow the recommended strategy); however, Eliaz 
does not require an analogue of t-immunity. 

In this paper, we are interested in the question of when a (k, t)-robust equilibrium a in a game 
with a mediator extending an underlying game T can be implemented by an e-(k, t)-robust equilibrium 
a' in the cheap-talk extension r C x of V. If this is the case, we say that a' is an e-(k, t)-robust imple- 
mentation of a. (We sometimes say that (Tct, a') is an e-(k, t)-robust implementation of (T^, a) if we 
wish to emphasize the games.) 

3 The Possibility Results 

All of our possibility results have the flavor "if there is a (k, t)-robust equilibrium in a game with a 
mediator, then (under the appropriate assumptions) we can implement this equilibrium using cheap 
talk." To state the results carefully, we must define the notions of a punishment strategy and a utility 
variant. 



11 



Definition 7. IfTj is an extension of an underlying game V with a mediator d, a strategy profile p in 
T is a k -punishment strategy with respect to a strategy profile a in Td if for all subsets K C N with 
\K\ < k, all strategies (pinT + CT{K), all types tx € Tg, and all players i £ K: 

Ui(t K ,r d ,a) > Ui(t K ,r + ct{k),4> k ,p-k)- 

If the inequality holds with > replacing >, p is a weak k-punishment strategy with respect to a. 

Intuitively, p is /c-punishment strategy with respect to a if, for any coalition K of at most k players, 
even if the players in K share their type information, as long as all players not in K use the punishment 
strategy in the underlying game, there is nothing that the players in K can do in the underlying game 
that will give them a better expected payoff than playing a in Td- 

Notice that if k + t < n < 2k + t, Td is a mediator game extending T, and a is a (k, t)-robust 
equilibrium in Yd, then there cannot be a (k + i)-punishment strategy with respect to a. For if a is 
a (A; + i)-punishment strategy, consider the strategy in the mediator game where a set T with \T\ = 
t > n — (k + t) players do not send a message to the mediator, and just play p. If a is t-immune, 
Ui(aN-T, Pr) > Ui(a). But in the underlying game, if the players in N — T share their types, they can 
compute what the mediator would have said, and thus can play ctn-t, contradicting the assumption that 
a is a punishment strategy. 

The notion of utility variant is used to make precise that certain results do not depend on knowing 
the players' utilities; they hold independently of players' utilities in the game. A game T' is a utility 
variant of a game r if T ' and T have the same game tree, but the utilities of the players may be different 
in T and T ' '. Note that if T ' is a utility variant of T, then T and T ' have the same set of strategies. We 
use the notation T(u) if we want to emphasize that u is the utility function in game T. We then take 
r(it') to be the utility variant of T with utility functions u'. 

We say that broadcast can be simulated, if for all 5 > 0, broadcast channels can be implemented 
with probability 1 — 5. Broadcast can be simulated if, for example, there are broadcast channels; or if 
there is a trusted preprocessing phase where players may broadcast and assuming cryptography; or if 
unconditional pseudo-signatures are established [PW96] . 

In the theorem, we take "assuming cryptography" to be a shorthand for the assumption that oblivious 
transfer [Rab, EGL85] can be implemented with probability 1 — e for any desired e > 0. It is known that 
this assumption holds if enhanced trapdoor permutations exist, players are computationally bounded, 
and the mediator can be described by a polynomial-size circuit [Gol04]. 

Theorem 1. Suppose that T is Bayesian game with n players and utilities u, d is a mediator that can be 
described by a circuit of depth c, and a is a (k, t)-robust equilibrium of a game Td with a mediator d. 

(a) If3(k + t) < n, then there exists a strategy Oct in r CT (it) such that for all utility variants T(u'), 
if a is a (k,t)-robust equilibrium ofTd{u'), then (T CT (u'), o~ C t) implements (Td(u'),a). The 
running time of a C 7 is O(c). 

(b) If 2k + 3t < n and there exists a {k + t)-punishment strategy with respect to a, then there exists 
a strategy ct C t in T C j such that ct C t implements a. The expected running time of Vct is O(c). 

(c) If 2{k + t) < n and broadcast channels can be simulated, then, for all e > 0, there exists a 
strategy a^ T in T CT such that a^ T e-implements a. The running time ofa^j is O(c). 

(d) If k + t < n then, assuming cryptography and that a PKI is in place, there exists a strategy a^ T 
in r CT such that a^ T e-implements a. The expected running time of o~q T is 0(c) • f(u) ■ 0(l/e) 
where f(u) is a function of the utilities. 
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(e) If k + 3t < n or if k + t < n and a trusted PKI is in place, and there exists a (k + t)-punishment 
strategy with respect to a, then, assuming cryptography, there exists a strategy <Tq T in Tqi such 
that o~q T e-implementers a. The expected running time of a e CT is 0(c) • f(u) where f{u) is a 
function of the utilities but is independent of e. 

Note that in part (a) we say "the running time", while in the other parts we say "the expected running 
time". Although all the strategies used are behavior strategies (and thus use randomization), in part (a), 
the running time is bounded, independent of the randomization. In the remaining parts, we cannot put 
an a priori bound on the running time; it depends on the random choices. As our lower bounds show, 
this must be the case. 

We briefly comment on the differences between Theorem 1 and the corresponding Theorem 4 of 
ADGH. In ADGH, we were interested in finding strategies that were not only (k, t)-robust, but also 
survived iterated deletion of weakly dominated strategies. Here, to simplify the exposition, we just 
focus on (k, t)-robust equilibria. For part (a), in ADGH, a behavioral strategy was used that had no 
upper bound on running time. This was done in order to obtain a strategy that survived iterated deletion. 
However, it is observed in ADGH that, without this concern, a strategy with a known upper bound can 
be used. As we observed in the introduction, part (a), as stated, actually follows from known results 
in multiparty computation [BGW88, CCD88]. Part (b) here is the same as in ADGH. In part (c), we 
assume here the ability to simulate broadcast; ADGH assumes cryptography. As we have observed, in 
the presence of cryptography, we can simulate broadcast, so the assumption here is weaker. In any case, 
as observed in the introduction, part (c) follows from known results [RB89]. Parts (d) and (e) are new, 
and will be proved in [ADGH07]. The proof uses ideas from [GMW87] on multiparty computation. For 
part (d), where there is no punishment strategy, ideas from [EGL85] on getting e-fair protocols are also 
required. (An e-fair protocols is one where if one player knows the mediator's value with probability p, 
then other players know it with probability at least p — e.) Our proof of part (e) shows that if n > k + 3t, 
then we can essentially set up a PKI on the fly. These results strengthen Theorem 4(d) in ADGH, where 
punishment was required and n was required to be greater than k + 2t. 



4 The Impossibility Results 
No bounded implementations 

We prove that it is impossible to get an implementation with bounded running time in general if 2k + 
3t < n < 3k + 3t. This is true even if there is a punishment strategy. This result is optimal. If 
3k + 3t < n, then there does exist a bounded implementation; if 2k + 3t < n < 3k + 3t there exists an 
unbounded implementation that has constant expected running time. 

Theorem 2. If2k + 3t < n < 3k + 3t, there is a game T and a strong (k,t)-robust equilibrium a 
of a game with a mediator d that extends V such that there exists a (k + t) -punishment strategy 
with respect to a for which there do not exist a natural number c and a strategy a C 7 m the cheap talk 
game extending T such that the running time of a C 7 ° n the equilibrium path is at most c and o~ct is a 
(k, t)-robust implementation of a. 

Proof. We first assume that n = 3, k = 1, and t = 0. We consider a family of 3-player games T^ ,k+t , 
where 2k + 3t < n < 3k + 3t, defined as follows. Partition {1, . . . , n} into three sets B\, B2, and B3, 
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such that Bi consists of the first [n/3\ elements in {1, . . . , n}, B3 consists of the last [~n/3] elements, 
and B2 consists of the remaining elements. 

Let p be a prime such that p > n. Nature chooses a polynomial / of degree k + t over the p- 
element field GF(p) uniformly at random. For i G {1,2, 3}, player i's type consists of the set of pairs 
{(h, f(h)) I h € Bi}. Each player wants to learn /(0) (the secret), but would prefer that other players 
do not learn the secret. Formally, each player must play either or 1. The utilities are defined as follows: 

• if all players output /(0) then all players get 1; 

• if player i does not output /(0) then he gets —3; 

• otherwise players i gets 2. 

Consider the mediator game where each player is supposed to tell the mediator his type. The medi- 
ator records all the pairs (h, Vh) it receives. If at least n — t pairs are received and there exists a unique 
degree k + t polynomial that agrees with at least n — t of the pairs then the mediator interpolates this 
unique polynomial /' and sends f'(0) to each player; otherwise, the mediator sends to each player. 

Let (7i be the strategy where player i truthfully tells the mediator his type and follows the mediator's 
recommendation. It is easy to see that a is a (l,0)-robust equilibrium (i.e., a Nash equilibrium). If 
a player i deviates by misrepresenting or not telling the mediator up to t of his shares, then everyone 
still learns; if the player misrepresents or does not tell the mediator about more of his shares, then the 
mediator sends the default value 0. In this case i is worse off. For if is indeed the secret, which it is 
with probability 1/2, i gets 1 if he plays 0, and —3 if he plays 1. On the other hand, if 1 is the secret, 
then i gets 2 if he plays 1 and —3 otherwise. Thus, no matter what i does, his expected utility is at most 
— 1/2. This argument also shows that if pt is the strategy where % decides no matter what, then p is a 
1-punishment strategy with respect to a. 

Suppose, by way of contradiction, that there is a cheap-talk strategy a' in the game r C x that imple- 
ments cr such that any execution of a' takes at most c rounds. We say that a player i learns the secret by 
round b of a 1 if, for all executions (i.e., plays) r and r' of a' such that i has the same type and the same 
message history up to round 6, the secret is the same in r and r' . Since we have assumed that all plays 
of a' terminate in at most c rounds, it must be the case that all players learn the secret by round c of a'. 
For if not, there are two executions r and r 1 of a' that i cannot distinguish by round c, where the secret 
is different in r and r'. Since i must play the same move in r and r' , in one case he is not playing the 
secret, contradicting the assumption that a' implements a. Thus, there must exist a round b < c such 
that all three players learn the secret at round b of a' and, with nonzero probability, some player, which 
we can assume without loss of generality is player 1, does not learn the secret at round b — 1 of a'. This 
means that there exists a type t\ and message history hi for player 1 of length 6 — 1 that occurs with 
positive probability when player 1 has type t\ such that, after 6—1 rounds, if player 1 has type t\ and 
history hi, player 1 considers it possible that the secret could be either or 1. Thus, there must exist 
type profiles t and t' that correspond to polynomials / and /' such that t\ = t[, /(0) / f'(0) and, with 
positive probability, player 1 can have history hi with both t and t', given that all three players play a'. 

Let h2 be a history for player 2 of length 6—1 compatible with t and hi (i.e., when the players play 
a', with positive probability, player 1 has hi, player 2 has /12, and the true type profile is t); similarly, 
let /13 be a history of length 6 — 1 for player 3 compatible with t! and h\. Note that player z's action 
according to <jj is completely determined by his type, his message history, and the outcome of his coin 
tosses. Let o-' 2 [t2, ^2] be the strategy for player 2 according to which player 2 uses a' 2 for the first 6—1 
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rounds, and then from round 6 on, player 2 does what it would have done according to a' 2 if its type had 
been ti and its message history for the first 6—1 rounds had been h% (that is, player 2 modifies his actual 
message history by replacing the prefix of length 6 — 1 by h 2 , and leaving the rest of the message history 
unchanged). We can similarly define a' 3 [t' 3 , hs). Consider the strategy profile (a[, a' 2 [t2, h2],o' 3 [t' 3: /13]). 
Since a^U, hi] is identical to o\ for the first 6 — 1 steps, for % = 2, 3, there is a positive probability that 
player 1 will have history h\ and type t\ when this strategy profile is played. It should be clear that, 
conditional on this happening, the probability that player 1 plays or 1 is independent of the actual 
types and histories of players 2 and 3. This is because players 2 and 3's messages from time b depend 
only on i's messages, and not on their actual type and history. Thus, for at least one of and 1, it must 
be the case that the probability that player 1 plays this value is strictly less than 1. Suppose without loss 
of generality that the probability of playing /(0) is less than 1. 

We now claim that cr' 3 [t' 3 , h 3 ] is a profitable deviation for player 3. Notice that player 3 receives the 
same messages for the first b rounds of a' and (a[ , a' 2 , a' 3 [t 3 , h 3 ]). Thus, player 3 correctly plays the 
secret no matter what the type profile is, and gets payoff of at least 1. Moreover, if the type profile is 
t, then, by construction, with positive probability, after 6—1 steps, player l's history will be h\ and 
player 2's history will be h 2 . In this case, a' 2 is identical to a' 2 [t2, /12], so the play will be identical to 
(a[ , a' 2 [t 2 , /12], a 3 [t 3 , h 3 ]). Thus, with positive probability, player 1 will not output /(0), and player 3 
will get payoff 2. This means player 3's expected utility is greater than 1. 

For the general case, suppose that 2k + 3t < n < 3k + 3t. Consider the n-player game Y n,k,t , 
defined as follows. Partition the players into three groups, Bo, B\, and B 2 , as above. As in the 3-player 
game, nature chooses a polynomial / of degree k + t over the field {0, 1} uniformly at random, but 
now player i's type is just the pair (i, f(i)). Again, the players want to learn /(0), but would prefer that 
other players do not learn the secret, and must output a value in F. The payoffs are similar in spirit to 
the 3-player game: 

• if at least n — t players output /(0) then all players that output /(0) get 1; 

• if player i does not output /(0) then he gets —3; 

• otherwise player i gets 2. 

The mediator's strategy is essentially identical to that in the 3-player game (even though now it is 
getting one pair (h,Vh) from each player rather than a set of such pairs from a single player). Similarly, 
each player i's strategy in r^' fc '*, which we denote cr™, is essentially identical to the strategy in the 3- 
player game with the mediator. Again, if pf is the strategy in the n-player game where i plays no 
matter what his type, then it is easy to check that p n is a (k + t)-punishment strategy with respect to a 11 . 

Now suppose, by way of contradiction, that there exists a strategy a' in the cheap-talk extension 
T^j' 1 of r n,fc '* that is a (k, £)-robust implementation of a n such that all executions of a' take at most 
c rounds. We show in Appendix A.3 that we can use a' to get a (l,0)-robust implementation in the 
3-player mediator game T 3 ' d , contradicting the argument above. □ 

Byzantine Agreement and Game Theory 

In [ADGH06] it is shown that if n > 3k+3t, we can implement a mediator in a way that does not depend 
on utilities and does not need a punishment strategy. Using novel connections to randomized Byzantine 
agreement lower bounds, we show that neither of these properties hold in general if n < 3k + 3t. 
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We start by showing that we cannot handle all utilities variants if n < 3k + 3t. Our proof exposes 
a new connection between utility variants and the problem of Weak Byzantine Agreement [Lam83]. 
Lamport [Lam83] showed that there is no deterministic protocol with bounded running time for weak 
Byzantine agreement if t > n/3. We prove a stronger lower bound for any randomized protocol that 
only assumes that the running time has finite expectation. 

Proposition 1. If max{2, k + t] < n < 3k + 3t, all 2 n input values are equally likely, and P is a 
(possibly randomized) protocol with finite expected running time (that is, for all protocols P" and sets 
\T\ < k + t, the expected running time of processes Pn-t given (Pn-t-,Pt) is finite), then there 
exists a protocol P 1 and a set T of players with \T\ < k + t such that an execution of (Pjv-Tj Pt) ™ 
unsuccessful for the weak Byzantine agreement problem with nonzero probability. 

Proof. See Appendix A. 1. □ 

The idea of our impossibility result is to construct a game that captures weak Byzantine agreement. 
The challenge in the proof is that, while in the Byzantine agreement problem, nature chooses which 
processes are faulty, in the game, the players decide whether or not to behave in a faulty way. Thus, we 
must set up the incentives so that players gain by choosing to be faulty iff Byzantine agreement cannot 
be attained, while ensuring that a (k, i)-robust cheap-talk implementation of the mediator's strategy in 
the game will solve Byzantine agreement. 

Theorem 3. If 2k + 2t < n < 3k + 3t, there is a game T(u) and a strong (k, t)-robust equilibrium 
a of a game with a mediator d that extends V such that there exists a (k + t)-punishment strategy 
with respect to a and there does not exist a strategy Oct smc/z that for all utility variants T(u') ofT(u), 
if a is a (k,t)-robust equilibrium ofT^u'), then (T CT (u'), ctct) is a (k,t)-robust implementation of 

Proof. See Appendix A. 1. □ 

Theorem 3 shows that we cannot, in general, get a uniform implementation if n < 3k + 3t. As shown 
in Theorem l(b)-(e), we can implement mediators if n < 3k + 3t by taking advantage of knowing the 
players' utilities. 

We next prove that if 2k-\-3t < n < 3k+3t, although mediators can be implemented, they cannot be 
implemented without a punishment strategy. In fact we prove that they cannot even be e-implemented 
without a punishment strategy. Barany [Bar92] proves a weaker version of a special case of this result, 
where n = 3, k = 1, and t = O.It is not clear how to extend Barany's argument to the general case, or to 
e-implementation. We use the power of randomized Byzantine agreement lower bounds for this result. 

Theorem 4. If 2k + 2t < n < 3k + 3t, then there exists a game T, an e > 0, and a strong (k, t)-robust 
equilibrium a of a game with a mediator d that extends V, for which there does not exist a strategy 
Ctct in the CT game that extends T such that <7ct is an e—(k, t) -robust implementation of a. 

Proof. See Appendix A.2. □ 

We now show that the assumption that n > 2k + 3t in Theorem 1 is necessary. More precisely, we 
show that if n < 2k + 3t, then there is a game with a mediator that has a (k, t)-robust equilibrium that 
does not have a (k, i)-robust implementation in a cheap-talk game. We actually prove a stronger result: 
we show that there cannot even be an e-(k, t)-robust implementation, for sufficiently small e. 
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Theorem 5. If k + 2t < n < 2k + 3t, there exists a game V, a strong (k, t)-robust equilibrium a of a 
game with a mediator d that extends V, a (k + t) -punishment strategy with respect to a, and ane > 0, 
such that there does not exist a strategy <7ct in the CT extension ofT such that o~ct w an e—(k, t) -robust 
implementation of a. 

The proof of Theorem 5 splits into two cases: (1) 2k + 2t < n < 2k + 3t and t > 1 and (2) k + 2t < 
n < 2k + 2t. For the first case, we use a reduction to a generalization of the Byzantine agreement 
problem called the (k, t) -Detect/Agree problem. This problem is closely related to the problem of 
broadcast with extended consistency introduced by Fitzi et al. [FHHW03]. 

Theorem 6. If 2k + 2t < n < 2k + 3t and t > 1, there exists a game V, an e > 0, a strong (k, t)- 
robust equilibrium a of a game with a mediator d that extends T, and a (k + t)-punishment strategy 
with respect to a, such that there does not exist a strategy o~ct in the CT extension of T which is an 
e—(k, t)-robust implementation of a. 

Proof. See Appendix A.4. □ 

We then consider the second case of Theorem 5, where k + 2t < n < 2k + 2t. Since we do not 
assume players know when other players have decided in the underlying game, our proof is a strength- 
ening of the lower bounds of [SRA8 1 , Hel05] . 

Theorem 7. Ifk + 2t < n < 2k + 2t, there exist a game T, an e > 0, a mediator game T^ extending T, 
a strong (k, t)-robust equilibrium a ofT^, and a {k + t)-punishment strategy p with respect to a, such 
that there is no strategy Oct that is an e—(k, t)-robust implementation of a in the cheap-talk extension 
ofT, even with broadcast channels. 

Proof. See Appendix A.5. □ 

Our last lower bound using Byzantine agrement impossibilities gives tight bounds to the result of 
Theorem 1(e) for the case that n > k + 3t. We show that a PKI cannot be set up on the fly if n < k + 3t. 
Our proof is based on a reduction to a lower bound for the (A;, t)-partial broadcast problem, a novel 
variant of Byzantine agreement that can be viewed as capturing minimal conditions that still allow us to 
prove strong randomized lower bounds. 

Theorem 8. ijfmax(2, k + t) < n < k + 3t, then there is a game V, a strong (k, t)-robust equilibrium 
a of a game with a mediator d that extends V for which there does not exist a strategy <Tct in the 
CT game that extends V such that Oct is on e—(k,t) -robust implementation of a even if players are 
computationally bounded and we assume cryptography. 

Proof. See Appendix A.6. □ 
Tight bounds on running time 

We now turn our attention to running times. We provide tight bounds on the number of rounds needed 
to e-implement equilibrium when k + 1 < n < 2(k + 1). When 2{k + 1) < n then the expected running 
time is independent of the game utilities and independent of e. We show that for k + t < n < 2{k + t) 
this is not the case. The expected running time must depend on the utilities, and if punishment does not 
exist then the running time must also depend on e. 



17 



Theorem 9. Ifk + t<n< 2{k + t) and k > 1, then there exists a game V, a mediator game that 
extends V, a strategy a in T^, and a strategy p in T such that 

(a) for all e and b, there exists a utility function u b,e such that a is a (k,t)-robust equilibrium in 
T d(u b ' e ) for all b and e, pisa (k, t) -punishment strategy with respect to a in T(u b,e ) ifn > k + 2t, 
and there does not exist an e—(k, t)-robust implementation of a that runs in expected time b in the 
cheap-talk extension r C j(u b ' e ) ofT(u b,e ); 

(b) there exists a utility function u such that a is a (k, t)-robust equilibrium in Td{u) and, for all b, 
there exists e such that there does not exist an e—(k, t)-robust implementation of a 1 that runs in 
expected time b in the cheap-talk extension T CT (u) ofT{u). 

This is true even if players are computationally bounded, we assume cryptography and there are broad- 
cast channels. 

Proof. See Appendix A.7. □ 

Note that, in part (b), it is not assumed that there is a (k, t)-punishment strategy with respect to 
a in r(u). With a punishment strategy, for a fixed family of utility functions, we can implement an 
e-(k, t)-robust strategy in the mediator game using cheap talk with running time that is independent of 
e; with no punishment strategy, the running time depends on e in general. 

5 Conclusions 

We have provided conditions under which a (k, t) -robust equilibrium with a mediator can be imple- 
mented using cheap talk, and proved essentially matching lower bounds. There are still a few gaps in 
our theorems, as well as other related issues to explore. We list some of them here. 

• In Theorem 1(c), we get only an e-implementation for some e > 0. Can we take e = here? 

• We require that the cheap-talk implementation be only a Nash equilibrium. But when we use a 
punishment strategy, this may require a player to do something that results in him being much 
worse off (although in equilibrium this will never occur, since if everyone follows the recom- 
mended strategy, there will never be a need for punishment). It may be more reasonable to re- 
quire that the cheap-talk implementation be a sequential equilibrium [KW82] where, intuitively, a 
player is making a best response even off the equilibrium path. To ensure that the cheap-talk strat- 
egy is a sequential equilibrium, Ben-Porath [Ben03] requires that the punishment strategy itself 
be a Nash equilibrium. We believe for our results where a punishment strategy is not required, 
the cheap-talk strategy is in fact a sequential equilibrium and, in the cases where a punishment 
strategy is required, if we assume that the punishment strategy is a Nash equilibrium, then the 
cheap-talk strategy will be a sequential equilibrium. However, we have not checked this carefully. 
It would also be interesting to consider the extent to which the cheap-talk strategy satisfies other 
refinements of Nash equilibrium, such as perfect equilibrium [Sel75]. 

• Our focus in this paper has been the synchronous case. We are currently exploring the asyn- 
chronous case. While we had originally assumed that implementation would not be possible in 
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the asynchronous case, it now seems that many of the ideas of our possibility results carry over 
to the asynchronous case. However, a number of new issues arise. In particular, we need to be 
careful in dealing with uncertainty. The traditional assumption in game theory is to quantify all 
uncertainty probabilistically. But with asynchrony, part of the uncertainty involves, how long it 
will take a message to arrive and when agents will be scheduled to move. (In general, in an asyn- 
chronous setting, one player can make many moves before a second agent makes a single move.) 
It is far from clear what an appropriate distribution would be to characterize this uncertainty. 
Thus, the tradition in distributed computing has been to assume that an adversary decides mes- 
sage delivery time and when agents are scheduled. The results in the asynchronous case depend 
on how we deal with the uncertainty, which in turn affects the notion of equilibrium. 

• We have assumed that in the cheap-talk game, every player can talk directly to every other player. 
It would be interesting to examine what happens if there is a communication network which 
characterizes which players a given player can talk to directly. 

• In the definition of t-immunity and (k, t) -robustness, we have allowed the players in T to use 
arbitrary strategies. In practice, we may be interested only in restricting each player i in T to 
using a strategy in some predetermined set S^. 

We hope to return to all these issues in future work. 
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Appendix 



A Proofs 

This section includes the proofs for all results stated in the main text. We repeat the statement of the 
results for the readers' convenience. 

A.l Proof of Theorem 3 

In the weak Byzantine agreement problem, there are n processes, up to t of which may be faulty 
("Byzantine"). Each process has some initial value, either or 1. Some processes (chosen by nature) 
are faulty; their "intention" is to try to prevent agreement among the remaining processes. Each non- 
Byzantine process must decide or 1. An execution of a protocol P is successful for weak Byzantine 
agreement if the following two conditions hold: 

I. (Agreement:) All the non-Byzantine processes decide on the same value in {0, 1}. 

II. (Weak Nontriviality:) If all processes are non-Byzantine and all processes have the same initial 
value i, then all the processes must decide i. 

Proposition 1. If max{2, k + t} < n < 3k + 3t, all 2 n input values are equally likely, and P is a 
(possibly randomized) protocol with finite expected running time, then there exists a protocol P' and a 
set T of players with \T\ < k + t such that an execution of (Pn-t, Pj<) unsuccessful for the weak 
Byzantine agreement problem with nonzero probability. 

Proof. The proof is based on the argument of [FLM86]. Partition the processes N = {1, . . . , n} into 
three sets Bq,B\, B>2 such that \B{\ < k + t. Let r\ , . . . , r n be the random tapes such that process i uses 
tape rj. 

Let c be an integer parameter that will be fixed later and consider the scenario consisting of 2cn pro- 
cesses arranged into 6cre sets Aq, Ai, . . . , Ae cn -i. The number of processes in the set A4 is |_Bj ( mod 3 \|, 
and the indexes of processes Ai correspond to the indexes of processes in the set B i ( mod 3 \ . Thus, for 
each value j in N, there are 2c processes whose index is set to j. If j £ Bi then there is exactly one 
such process in each set A 3 £ +i for £ G {0, 1, . . . , 2c — 1}. 

Each process whose index is j € N executes protocol Pj with random tape rj. Messages sent by 
processes in Ai according to P reach the appropriate recipients in Aj_i t mo & 6cn)> Aj, A i+ i ( mod ecn y, 
the processes in Ai start with 1 if — 6cn/4 (mod 6cn) < i < 6cn/4 (mod 6cn) and otherwise. 

Any two consecutive sets A4, A i+i ( mod 6m ) define a possible scenario denoted Si where the non- 
faulty processes, Ai,A i+1 ( mod 6cn \, execute P and the faulty processes simulate the execution of all 
the remaining sets of processes. Let denote the probability that protocol P fails the weak Byzantine 
agreement conditions in scenario Si. 

Fix c = 2 5 b and consider the scenarios S\ and S^cn- Since the expected running time is at most b 
then by Markov inequality, with probability at least 7/8 the processes in Si require at most 86 rounds. 
So with probability at least 1/2 both the processes in Si and the processes in Ss m decide in at most 86 
rounds, denote this event as £. 
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Since we fixed c = 2 5 b and all processes that have the same index use the same random tape then 
given £ , we claim that the processes in Si cannot distinguish their execution from an execution where 
all processes are non-faulty and begin with a 1 and similarly processes in S^cn cannot distinguish their 
execution from an execution where all processes are non-faulty and begin with a 0. Therefore, given 
£, the non-faulty processes in Si decide 1 and the non-faulty processes in Ss cn decide 0. Given £, it 
cannot be the case that e« = for all i. Hence there must exist an index i such that > given £. 

Now consider the strategy P' for processes in B i _ 1 ( mod 3 ) that guesses the random tapes of the 
processes in B>i, B i+ i ( mod 3 ) and simulates the processes Aq,A±, . . . , AQ Cn ^i except for the processes 
in Ai, A i+ i ( mod g cn y With non-zero probability, the initial values of the non-faulty processes will be 
as the initial values of Ai, A i+i ( mod 6cn ). Given this, with probability 1/2 event £ occurs. Given this, 
the faulty processes may guess the tapes of the non-faulty processes with non-zero probability. Given 
this, with probability a > the non-faulty processes will fail. □ 

Theorem 3. If 2k + It < n < 3k + 3t, there is a game T{u) and a strong (k, t)-robust equilibrium 
a of a game with a mediator d that extends V such that there exists a {k + t) -punishment strategy 
with respect to a and there does not exist a strategy Oct su ch that for all utility variants T(u') ofT{u), 
if a is a (k,t)-robust equilibrium ofTd(u'), then (T CT (u'), <t C t) is a (k,t)-robust implementation of 
(r d (u'),a). 

Proof. Consider the following game T with 2k + 2t < n < 3k + 3t players. A player's type is his 
initial value, which is either or 1. We assume that each of the 2 n tuples of types is equally likely. Each 
player must choose a characteristic G (for "good") or B (for "bad"); if the player chooses G, he must 
also output either 0, 1, or PUNISH. The utility function u is characterized as follows: 

• If there exists a set R of at least n — (k + t) players that choose G such that 

- all players in R either commonly output or commonly output 1 ; and 

- if all players in R have initial value % then the common output of R is i; 

then we call this a good outcome, the utility is 1 for players that choose G and output the same 
value as the players in R, and the utility is for all other players. 

• If n — (k + t) or more players choose G and output PUNISH or all players choose B, then we call 
this a punishment outcome; the utility is —1 for all players. 

• Otherwise we have a bad outcome, and the utility is — 2n for players that choose G and 2 for 
players that choose B. 

For future reference, we take the utility function u M to be identical to u, except that in a punishment 
outcome, a player that chooses B gets 2M, while a player that chooses G gets —2nM (so that u = u 1 ). 

Consider the strategy ai for player i in the game T^ with a mediator based on T where i sends its 
value to the mediator, and chooses characteristic G and outputs the value the mediator sends if the value 
is in {0, 1}, and outputs if the mediator sends PUNISH. The mediator sends PUNISH if there are less 
than n — (k + 1) values sent; otherwise it sends the majority value (in case of a tie, it sends 1). Let pi be 
the strategy in the underlying game T of choosing B and outputting 0. 

Lemma 2. The strategy a is a strong {k, t) -robust equilibrium in the utility variant game T d {u M )for 
all M. Moreover, a results in a good outcome and p is a {k + t)-punishment strategy with respect to a. 
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Proof. If \T\ < t, and all the players in N — T play a, then the mediator will get at least n — t values. 
If the majority value is i, then all the players in N — T will decide i. Since n > 2t, there must be at 
least one player in N — T that has type i. Moreover, \N — T\ > n — (k + t), so the players in N — T 
constitute a set R that makes the outcome good. Thus we have i-immunity. 

Now fix K, T C N such that K, T are disjoint, \K\ < k, and \T\ < t. Clearly for any t KuT G 
Skut, and i ^ K U T we have Ui(a_^xuT)^ T (KuT)) = 1- If at l east n — (k + t) players play a 
then the outcome will be good and all the players that play a will get a utility of 1, no matter what the 
other players do; moreover, any player that chooses B will get utility of 0. Here we need the fact that 
n > 2k + 2t, so there cannot be two sets of size at least n — (k + t) where the players output different 
values. It easily follows that a is a (k, t)-robust equilibrium. Note that if any set of n — (k + t) or more 
players play p in the underlying game T then, no matter what the remaining players do, the utility for 
all the players is —1, whereas, as we have seen, if n — (k + t) or more players play a in T^, then these 
players get 1. Thus, a is a (k + i)-punishment strategy with respect to a. □ 

Returning to the proof of Theorem 3, by way of contradiction, suppose that there exists a strategy a' 
in the CT extension r C x of T such that (T C t(u m ), a') is a (k, t)-robust implementation of (Td(u M ), a), 
for all M. Let Pi be the protocol for process i where process i sends messages according to a\, taking 
its initial value to be its type, decides I if a[ chooses G and outputs £ G {0,1}, and outputs if i chooses 
B or chooses G and outputs PUNISH. 

By Proposition 1, there exists a protocol P' , sets K, T with \K\ < k and \T\ < T, and an e > 
such that {P-ik\jt)i P'kut) nas probability e of having an unsuccessful execution. Without loss of 
generality, we can assume that \K\ = k and \T\ = t. (If not, we can just add k — \K\ processes to K and 
t — \T\ processes to T and have them all use protocol P.) Let a'j be the strategy where player j chooses 
B and sends messages according to Pj. It is easy to see that (o-'_^ KuT y a'^ uT ) results in a bad outcome 
whenever (P-(k\jt)i P'kut) resu l ts in an unsuccessful outcome. For if (o"'_(xut)' °kut) results in a 
punishment outcome, then all players not in K UT output with (P-(kut)i P'rut)' so tne outcome is 
successful. Thus, the probability of a bad outcome with {o~'_^ KvjT y o-" KyjT ) is e. 

Fix M > 2/e. In the game T C t(u m ), if j G K, we have (^-(kut)! a 'kuT) > ^ (since j's 
expected utility conditional on a bad outcome is greater than 4/e, and a bad outcome occurs with prob- 
ability e, while j's expected utility conditional on a good or punishment outcome is at least —1). Since 
a' is a (k, t)-robust equilibrium, if j G K, we must have Uj 4 (a'_ T , a'^) > uj 1 {&'_( KvjT y &kut) > 3- 
Thus, the probability of a bad outcome with (cr / _ T , a'^) must be positive. Note that t-immunity guar- 
antees that, for all i £ T, uf 1 (cr'_ T , a'^) > 1. Thus, the total expected utility of the players in N — T 
when playing {o~'_ T , a'^) must be at least n — t + 2k (since the players in K have expected utility at 
least 3). However, in a good outcome, their total utility n — (t + k); in a punishment outcome, their 
total utility is — n + t < 0; and in a bad outcome, their total utility is less than (since even if all but 
one of the players in N — (T — K) choose characteristic B and get utility 2M, the player who chooses 
characteristic G gets utility — 2Mn). Thus, the only way that the total expected utility of the players in 
N — T can be greater than n — t + 2k is if k = and the probability of a bad outcome (or a punishment 
outcome) with (o J , KuT y o" KyjT ) is 0. This gives us the desired contradiction, and completes the proof 
of Theorem 3. □ 
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A.2 Proof of Theorem 4 



Theorem 4. If 2k + 2t < n < 3k + 3t, then there exists a game T, an e > 0, and a strong (k, t)-robust 
equilibrium a of a game with a mediator d that extends V, for which there does not exist a strategy 
Oct in the CT game that extends T such that <7ct is an e—(k, t) -robust implementation of a. 

Proof. Consider a variant of the game described in the proof of Theorem 3: 

Game T has 2k + 2t < n < 3k + 3t players. Players are partitioned into three sets B\, -E>2, -B3 such 
that \Bi\ < k + t. Nature chooses three independent uniformly random bits 61, 62, 63 6 {0,1} and gives 
each player in Bi the type 6j. Each player must choose a characteristic G or B; if the player chooses G, 
he must also output either or 1. The utility function u is characterized as follows: 

• If there exists a set R of at least n — (k + t) players that choose G such that 

- all players in R either commonly output or commonly output 1 ; and 

- if all players in R have initial value i then the common output of R is i; 

then we call this a good outcome, the utility is 1 for players that choose G and output the same 
value as the players in R, and the utility is for all other players. 

• Otherwise we have a bad outcome, and the utility is for players that choose G and 16 for players 
that choose B. 

Consider the same mediator as in Theorem 3, except that rather than sending PUNISH if fewer than 
n — (k + t) values are sent, the mediator simply sends 0. Again, it is easy to see that the strategy a of 
sending the true type and following the mediator's advice is a (k, t)-robust equilibrium in the mediator 
game. Note that there is no (k + t) -punishment strategy with respect to a in this game. 

Let a' be any strategy in the cheap talk game r CT such that for any set K U T with \K U T\ < k + t 
and any protocol tkxjt the expected running time of (o~' N _^ KvjT yTKyjT) is finite. Let P be the protocol 
for Byzantine agreement induced by a'. Specifically, protocol P, simulates a\ by giving it its initial 
value, sending messages according to a\ and finally decide on the same value that a\ outputs. 

We use the following lower bound on randomized Byzantine agreement protocols. 

Proposition 3. If 2t < n < 3t and processes are partitioned into three sets Bi,B2, B3 such that 
\Bi\ < t. Nature chooses three independent uniformly random bits b\, 62, 63 £ {0, 1} and gives each 
player in Bi the initial value bi. Then there exists a function that maps protocols to protocols such 
that for any joint protocol P there exists a set T of processes such that T = B{for some i S {1,2, 3} 
and the execution (Pjv-T) *&(P)t) fails the Byzantine Agrement problem with probability at least 1/6. 
The running time of^f(P) is polynomial in the number of players and the running time of P. 

Proof. The proof follows from [KY84]. See Proposition 5 for a self contained proof that also handles 
this special case. □ 

Let T be the set whose existence is guaranteed by Proposition 3 for protocol P. Then consider 
the strategy tt in r CT where players choose B and play according to the protocol ^(P)t- Since with 
probability at least 1/6 the execution of (Pn~t, ^(P)t) fails the Byzantine Agrement problem then 
with probability at least 1/6 the execution of (a' N _ T , tt) reaches a bad outcome and the expected utility 
of each member in T is > 2. Hence there does not exist a (k + t) -robust equilibrium in the cheap talk 
game that can e-implement the equilibrium with a mediator for any e < 1. □ 
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A.3 Proof of Theorem 2 



Theorem 2. If 2k + 3t < n < 3k + 3t, there is a game V and a strong (k,t)-robust equilibrium a 
of a game with a mediator d that extends V such that there exists a {k + t) -punishment strategy 
with respect to a for which there do not exist a natural number c and a strategy o~ C i in the cheap talk 
game extending V such that the running time of Oct on the equilibrium path is at most c and o~ct is a 
(k, t)-robust implementation of a. 

Proof. It remains to show that we can use a 1 as defined in the main text to get a (1, 0)-robust imple- 
mentation in the 3-player mediator game T^ +t , contradicting the argument above. The idea is straight- 
forward. Player i in the 3-player game simulates the players in Bi in the n-player game, assuming that 
player j G Bi has type (j, f(j)). (Recall that, in the 3-player game, player i's type is a tuple consisting 
of (j, f(j)) for all j G Bi.) In more detail, consider the strategy a" where, in each round of the 3-player 
game, player i sends player j all the messages that a player in Bi sent to a player in Bj in the n-player 
game (noting what the message is, to whom it was sent, and who sent it). After receiving a round k 
message, each player i in the 3-player game can simulate what the players in Bi do in round k + 1 of 
the n-player game. If a player i does not send player j a message of the right form in the 3-player game, 
then all the players in Bj are viewed as having sent no message in the simulation. If all players in Bi 
decide on the same value in the simulation, then player i decides on that value in the 3-player game; 
otherwise, player i decides 0. 

It is easy to see that a" implements a in Y^ ,k+t and there is a bound c such that all executions 
of a take at most c rounds, because a' implements a n in the n-player game and takes bounded time. 
It follows from the argument above that a" cannot be (l,0)-robust. Thus, some player i must have 
a profitable deviation. Suppose without loss of generality that it is player 3, and 3's strategy when 
deviating is T3. Note that T3 can be viewed as prescribing what messages players in B3 send to the 
remaining players in the game T'^j T ,t . (Recall, that if player 3 does not send a message to player j in 
the 3-player game that can be viewed as part of such as description, and player j is running a", then 
player j acts as if all the players in B3 had sent the players in Bj no message at all. Thus, all messages 
from player i to player j in the 3-player game can be interpreted as messages from Bi to Bj in the 
n-player game.) Note that t < \B-^\ < k + t. (We must have k > 1, since otherwise we cannot have 
2k + 3t < n < 3k + 3t, so n > 3 + 3t.) Choose a subset T of B 3 such that \T\ = t. Let f Bs be the 
strategy in the n-player cheap-talk game whereby the players in B3 simulate T3, the players in B3 — T 
make the same decision as player 3 makes using T3, and the players in T make the opposite decision. It 
suffices to show that if all players in B3 play f, then the players in B3 — T are better off than they are 
playing a'. 

Note that every execution r of (o-' n _ b ^,tb z ) in the cheap-talk extension of T n,k,t corresponds to 
a unique execution r' of (a'L 2 }i r 3) i n the cheap-talk extension Y^' k,t . Thus, it suffices to show that 
the players in ^3 — T do at least as well in r as player 3 does in r'. Let R' , R[, and R' 2 be the set of 
executions of (crj^ 2 y, T3) where player 3 gets payoff —3, 1, and 2, respectively. Let Rj be the set of 
executions of (a' N __ B;j , t ! Bs ) that correspond to an execution of RL If r' £ R' , then clearly a player 
in B3 — T does at least as well in r as player 3 does in r' . If r' G R\, then all three players play the 
secret in r' . Thus, in r, all the players in B3 — T play the secret, so they all get at least 1. Finally, if 
r' G R' 2 , then in r', player 3 plays the secret, and either player 1 or 2 does not. Hence some player in 
B\ or B2 does not play the secret in the cheap-talk extension of Y n ' t,k . Moreover, all the players in T 
do not play the secret. Thus, at least t + 1 players do not play the secret, so the players in B3 — T get 2. 
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This completes the argument. 

□ 

A.4 Proof of Theorem 6 

Theorem 6. If 2k + It < n < 2k + 3t and t > 1, there exists a game V, an e > 0, a strong (k, t)- 
robust equilibrium a of a game T^ with a mediator d that extends V, and a {k + t) -punishment strategy 
with respect to a, such that there does not exist a strategy cjct in the CT extension of T which is an 
e-(k, t)-robust implementation of a. 

The proof uses a reduction to a generalization of the Byzantine agreement problem called the (k, t)- 
Detect/ Agree problem, which, as we said, is closely related to the problem of broadcast with extended 
consistency introduced by Fitzi et al. [FHHW03]. We have two parameters, k and t. Each process has 
some initial value, either or 1. There are at most k + t Byzantine processes. Each non-Byzantine 
process must decide 0, 1, or DETECT. An execution is successful for Detect/Agree if the following three 
conditions all hold (the first two of which are slight variants of the corresponding conditions in weak 
Byzantine agreement): 

I. (Agreement:) If there are t or fewer Byzantine processes, then all non-Byzantine processes decide 
on the same value, and it is a value in {0, 1}. 

II. (Nontriviality:) If all non-Byzantine processes have the same initial value v and no non-Byzantine 
process decides DETECT, then all the non-Byzantine processes must decide v. 

III. (Detection validity:) If there are more than t Byzantine processes, then either all the non-Byzantine 
processes decide DETECT, or all non-Byzantine processes decide on the same value in {0, 1}. 

Note that if k = 0, then clause III is vacuous, so the (0, t)-Detect/Agree problem is equivalent 
to Byzantine agreement with t faulty processes [LSP82]. Note that the non-triviality condition for 
Byzantine agreement requires all processes to decide v if they all had initial value v, even if there are 
some faulty processes. Thus, it is a more stringent requirement than the weak nontriviality condition of 
weak Byzantine agreement. 

The following argument, from which it follows that there does not exist a protocol for the (k,t)- 
Detect/Agree problem if n < 2k + 3t, is based on a variant of the argument used for Proposition 1. If 
T C N, let 1t0n-t denote the input vector where the players in T get an input of 1 and the players in 
N - T get an input of 0. 

Proposition 4. If max{2, t} < n < 2k + 3t and t > 1, then for all joint protocols P, there exist six 
scenarios So, ... , six protocols PL for j = 0, 1, h = 0,1,2, and a partition of the players into three 
nonempty sets Bq, B\, and B2 such that \ Bq \ < t, \ B\ \ < k + t, and \ B2 \ < k + t, and 

• in scenario So, the input vector is 0, in S±, it is O^u^l-Bo-' an d ^ n $2> it is 0b 2 ^b q vjb 1 : in S^ + h, 
the input vector is the complement of the input vector in Sh, for h = 0, 1, 2 (that is, if process i 
has input £ in Sh, it has input 1 — £ in S^+h); for all protocols P 3 , for j = 0, 1; 

• in S^j^h the processes in B^ are faulty and use protocol PL for j = 0, 1 and h = 0,1,2, while 
the remaining processes are correct and use protocol P; 

• the processes in Bh^ 3 2 receive exactly the same messages in every round of both both S^j+h and 
S^j + h^ 6 i (where we use (Be and Qe to denote addition and subtraction mod £). 
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Figure 1: The construction for the proof of Proposition 4. 



Proof. We explicitly construct the scenarios and protocols. Given P, we simultaneously describe the 
protocols P 3 h and scenarios S^j+h^ for j = 0, 1, h = 0, 1, 2, by induction, round by round. Suppose we 
have defined the behavior of protocol Pi and the scenario S^j+h for the first I rounds. As required by the 
proposition, in scenario Ssj^h, the processes in are faulty and use protocol P?, the correct processes 
use protocol P, and the inputs are as required by the protocol. The hexagon in Figure 1 implicitly 
defines the scenarios and what happens in round (£ + 1). In round £+ 1 of scenario S^+h, the processes 
in Bh are faulty; each process i G Bh sends messages to the processes in Bh^ 3 i as if i is using Pi and 
in the first k rounds has received exactly the messages it would have received in scenario Ssj + he 6 i, 
and sends messages to the processes in B^j + hQ 3 i as if i is using Pi and has received exactly the same 
messages it would have received in the first k rounds of S3j+h@ e i- Note that in scenarios Ssj+h® 6 i and 
Ssj+hQ 6 -i, a process i G By t uses protocol P{. Thus, % G Bh sends the same message to processes in 
.BhOg i in both scenarios S%j + h and S^j + h® 6 i- Finally, note that there is no need for processes in Bj % to 
send messages to other processes in Bh in scenario S%j + h- The behavior of the processes in Bh does not 
depend on the messages they actually receive in scenario S^j+h', they are simulating scenarios Szj+h® 6 i 
and Szj+heei- This behavior characterizes protocol P^. 

The six scenarios and protocols are implicitly defined by the hexagon in Figure 1. For example, 
scenario So is defined by the four nodes in the hexagon starting with the one labeled Pq and going 
counterclockwise. The inputs for the processes in Bh are defined by the numbers in circle in the first 
three nodes; in this scenario, all processes have input 0, because these numbers are all 0. The processes 
in Bq, which are the faulty ones in this scenario, behave to the processes in B\ as if they have input 
and to the processes in B2 as if they have input 1. (This is indicated by the edge joining the node labeled 
B o (0) and B x (0) and the edge joining B (l) and B 2 (0)). 

By construction, the processes in -E>h© 3 2 are correct in both Szj + h and Ssj + h^ 6 i', an easy proof 
by induction on rounds shows that they receive exactly the same messages in every round of both 
scenarios. □ 
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The following is a generalization of the well-known result that Byzantine agreement (which, as we 
have observed, is just the (0, t)-Detect/Agree problem) cannot be solved if n < 3t. 

Proposition 5. If n < 2k + 3t and t > 1, then there is no protocol that solves the (k, t) -Detect/Agree 
problem. Moreover, if there is a partition of the players into three nonempty sets Bq, B\, and B2, as in 
Proposition 4, and the four input vectors 0, 1_b 0b 1 u_b 2 ' 1-BoUBiOb 2 , and 1 each have probability 1/4 
then, for any protocol P, there exists a set T with \T\ <k + t and protocol P' such that the probability 
that an execution of{PN-T, Pj) is unsuccessful for (k, t)-Detect/Agree is at least 1/20. 

Proof. Suppose that n < 2k + 3t and that P solves the (k, t) -Detect/Agree problem. Consider the six 
scenarios from Proposition 4. Since t > 1, each of Bo, B\, and B2 is nonempty. In scenario So, all the 
correct processes must decide on 0, by the nontriviality condition. By Proposition 4, the processes in B2 
cannot distinguish So from Si and are correct in both, therefore the correct processes must decide in 
Si. Thus, by the agreement property (if \Bo\ < t) or the detection validity property (if I-B2I > t), all the 
processes in B\ must also decide in Si. A similar argument shows that all the processes in Bq U B\ 
must decide in S2 and all the processes in B\ U B2 must decide in S3. But in S3 the nonfaulty 
processes must decide 1 . This proves the first part of the claim. 

Now suppose that each of 0, 1b 0-BiU£ 2 > 1_b o uBi0b 2 , and 1 have probability 1/4. Again, consider 
the scenarios So, . . . , S3. We claim that, for some j G {0, 1, 2, 3}, if the faulty processes use the 
strategies prescribed for scenario Sj, then conditional on the input vector being that of scenario Sj, 
the probability that an execution is unsuccessful for (k, t)-Detect/ Agree is at least 1/5. We prove by 
induction on j that either the claim holds for some scenario Sj with < j < 3 or the probability that 
each correct process in scenario Sj decides is greater than 1 — (j + l)/5. For the base step, suppose 
that in scenario So some correct process decides 1 with probability greater than 1/5. Then if processes 
in Bq are faulty and use protocol P®, no matter what their input, if the input vector is actually the 
execution will be unsuccessful with probability greater than 1/5. Assume now that the claim does not 
hold for processes in So. Since processes in B2 are correct in both So and Si, and cannot distinguish 
So from Si, they must decide with probability at least 4/5 in Si. A similar argument now shows that 
either the claim holds for Si, or the processes in Bo must decide with probability at least 3/5 in Si. 
The inductive step is similar, and left to the reader. We complete the proof by observing that in S3, if 
the claim does not hold, then all the processes must decide with probability at least 1/5. But in S3, all 
processes are correct and have initial value 1. Thus, again the probability of an unsuccessful execution 
is at least 1/5. Since each relevant input vector has probability 1/4, the probability of an unsuccessful 
execution is at least 1/20. □ 

Proof of Theorem 6. Suppose that 2k + 2t < n < 2k+3t, t > 1. Consider the same game and strategies 
as in the proof of Theorem 3 with utility vector u M , where M > 20(1 + e). By Lemma 2, a is a (k, t)- 
robust strategy in the mediator game T^. Suppose, by way of contradiction, that a' is an e-(k, t)-robust 
implementation of a in the CT extension r C x of Td(u M ). Let Pi be the protocol for process i that sends 
the same messages and makes the same decisions as a\. By Proposition 5, there is a protocol P' and 
a set T with \T\ < k + t such that the probability that an execution of (Pn-t, Pj) i s unsuccessful 
for (k, t) -Detect/ Agree is at least 1/20. Let a" be the strategy where the players choose characteristic 
B and play according P' in the cheap-talk game, no matter what their actual input. With probability 
1/20, the outcome will be bad (since an unsuccessful outcome with (P/v_y, Plj) corresponds to a bad 
outcome with (a' N _ T , a'^). Thus, the expected utility for the players in T is greater than 1 + e, so a' is 
not e-(k, i)-robust. □ 



27 





L 


R 




L 


R 


u 


(3,3) 


(1,4) 


U 


1/3 


1/3 


D 


(4,1) 


(0,0) 


D 


1/3 






A simple 2-player game. A correlated equilibrium. 

Figure 2: The game used in the proof of Proposition 6 

A.5 Proof of Theorem 7 

To prove Theorem 7, we start with the case that n = 2, k = 1, and t = 0. The ideas for this proof 
actually go back to Shamir, Rivest, and Adleman [SRA81]; a similar result is also proved by Heller 
[Hel05]. However, these earlier proofs assume that in the cheap-talk protocol, the players first exchange 
messages and then, after the message exchange, make their decision (perhaps using some randomiza- 
tion). That is, they are implicitly assuming that when the cheap-talk phase of the strategy has ended, it 
is common knowledge that it has ended (although when it ends may depend on some random choices). 
While this is a reasonable assumption if we have a bounded cheap-talk protocol, our possibility results 
involve cheap-talk games with no a priori upper bound on running time. We do not want to assume that 
the players receive a signal of some sort to indicate that the message exchange portion of the cheap-talk 
has ended. Our lower bound proof does not make this assumption. We can, of course, find a round 
such b that with high probability. This solves part of the problem. However, the earlier proofs also took 
advantage of the fact that players decide simultaneously, after the cheap-talk phase ends. Since we do 
not make this assumption, our proof requires somewhat more delicate techniques than the proofs in the 
earlier papers. 

Proposition 6. If n = 2, then there exist a game T, e > 0, a mediator game extending T, a Nash 
equilibrium a ofT^, and a punishment strategy p with respect to a such that there is no strategy a' that 
is an e— (1, 0)-robust implementation of a. 

Proof. Let T be the game described in the left table of Figure 2, where player 1 is Alice and player 2 is 
Bob, Alice can choose between actions U and D, and Bob can choose between L and R. The players 
all have a single type in this game, so we do not describe the types. The boxes in the left table describe 
the utilities of Alice and Bob for each action profile. The right table describes a correlated equilibrium 
of this game, giving the probabilities that each action profile is played. 

Consider the mediator game Yd extending T, where the mediator recommends the correlated equi- 
librium described in the table on the right of Figure 2 (that is, the mediator recommends choosing an 
action profile with the probability described in the table, and recommends that each player play his/her 
component of the action profile). Let a be the strategy profile of following the mediator's recommen- 
dation. It is easy to see that a is a Nash equilibrium of the mediator game; moreover, (D, R) is a 
punishment strategy with respect to a. Also, note that the requirement of a broadcast channel trivially 
holds if n = 2. 

Suppose, by way of contradiction, that a' = (a[, a' 2 ) is a (1/10)-Nash equilibrium that implements 
a in a CT extension r CT of T^. Since a' implements a, it must be the case that, with probability 1, 
an execution of a' terminates. Hence, there must be some round b such that, with probability at least 
1 — -jp , a' has terminated (with both players choosing an action in the underlying game) by the end of 
round b. (We determine [3 shortly.) 
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The execution of a' is completely determined by the random choices made by the players. Let IZi 
denote the set of possible sequences of random choices by player i. (For example, if player i randomizes 
by tossing coins, then r G TZi can be taken to be a countable sequence of coin tosses.) For ease of 
exposition, we assume that i makes a random choice at every time step (if the move at some time step 
in the cheap-talk game is deterministic, then i can ignore the random choice at that time step). If r is a 
sequence of random choices, we use r e to denote the subsequence of r consisting of the random choices 
made in the first t steps. Since a' implements a, with probability 1 , both players choose an action in the 
underlying game in an execution of a'. (That is, while it is possible that there are infinite executions of 
a' where some party does not choose an action, they occur with probability 0.) Let 1Z = 1Z\X 1Z 2 . Note 
that the probability on the random sequences in 1Z determines the probability of outcomes according to 
a'. 

Suppose that r is a finite random sequence of length t for player i. We take Pr(r) = Pr({s G 
TZi : s e = r}). We similarly define Pr(ri,r2) for a pair (ri,r 2 ) of finite sequences of equal length. 
The random sequences determine the message history and the actions. Given random sequences n and 
r 2 of length I, let H(ri, r 2 ) be the pair of message histories (hi, h 2 ) determined by (n, r 2 ), and let 
A(ri,r 2 ) = (ai,a 2 ) be the action profile chosen as a result of (n, r 2 ) (where we take a; t to be _L if 
player i has not yet taken an action); in this case, we write Ai(ri,r 2 ) = ctj, for i = 1, 2. 

A pair of histories (hi, h 2 ) of equal length is deterministic for player i if it is not the case that both of 
player z's actions have positive probability, conditional on the message history being (hi, h 2 ). We claim 
that all history pairs that arise with positive probability must be deterministic for some player i. For sup- 
pose that a history pair (hi, h 2 ) is not deterministic for either player. Let 7^ = {(ri,r 2 ) : Ai(ri,r 2 ) = 
D,H(n,r 2 ) = (hi,h 2 )} and let TZ 2 = {(n,r 2 ) : A 2 (ri,r 2 ) = R,H(n,r 2 ) = (hi,h 2 )}. By assump- 
tion, Pr(^; I (hi,h 2 )) > and Pr(K' 2 | (hi,h 2 )) > 0. Now let K' 3 = {(n,r 2 ) : 3r[, r' 2 ((n, r' 2 ) G 
TZ'i, (r'i,r 2 ) G 7£ 2 }- It is easy to see that for (ri,r 2 ) G 1Z' 3 , we have H(n,r 2 ) = (hi, h 2 ) (we can 
prove by a straightforward induction that h(r[,r l 2 ) = (h\,h 2 ) for each round i less than or equal to the 
length of n). Hence A(n,r 2 ) = (D, R). Moreover, Pr(^' 3 | (hi,h 2 )) > Pr(^ | (hi, h 2 )) x Pr(^ 2 | 
(hi, h 2 )) > 0. Thus, if (hi, h 2 ) has positive probability, then the outcome (D, R) has positive proba- 
bility, which contradicts the assumption that a' implements a. 

Consider the following two strategies o'{ and a 2 for players 1 and 2, respectively. According to a", 
player 1 sends exactly the messages that he would have sent according to a[ until round b, but does 
not take an action until the end of round b. If player 1 observes the histories (hi,h 2 ) at the end of b 
rounds, and if the probability of player 2 playing L conditional on having observed (hi,h 2 ) is at least 
1 — 1/(3, then player 1 decides D, but keeps sending messages according to a[; otherwise, player 1 plays 
exactly according to a[ . (Note that computing whether to play U may be difficult, but we are assuming 
computationally unbounded players here.) The strategy a 2 is similar, except now player 2 will play R 
if conditional on (hi, h 2 ), player 1 plays U with probability at least 1 — 1/(3. It is easy to see that if 
player 1 plays a different action with o'{ when observing (hi, h 2 ) than with a[, it must be because a[ 
recommends U and player 1 plays D. Moreover, player l's expected gain in this case, conditional on 
observing (hi, h 2 ) (given that player 2 plays a' 2 ) is at least 1 • (1 — 1/(3)— 3- (1/(3) = 1 — 4/(3. Similarly, 
if player 2 plays a different action when observing (hi, h 2 ), then player 2's expected gain conditional 
on observing (hi, h 2 ) and that player 1 plays a' x is at least 1 — 4/(3. 

Let 1Z'(U, L) = {(ri,r 2 ) : A(n, r 2 ) = (U, L), n, r 2 have length b}. Since a' implements a, the 
probability of the outcome (U, L) with a' must be 1/3. Since b was chosen such that the probability of 
not terminating within Grounds is less than 1/ (3 2 , we must have Pr(lZ'(U, L)) > 1/3 — 1/ (3 2 . 
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Let H' consists of all message histories (hi, h 2 ) of length b such that, with probability at least 1/(3, 
at least one player does not terminate by the end of round b (where the probability is taken over pairs 
(ri,r 2 ) such that H(n,r 2 ) = (hi, h 2 )). The probability of H' must be at most 1/(3 (otherwise the 
probability of not terminating by the end of round b would be greater than 1/ (3 2 ) . Thus, for any history 
that is not in H' , the probability that both players take an action in a' is at least 1 — 1/(3. 

Let Tl"(U,L) = {(n,r 2 ) £ K?(U,L) : H(n,r 2 ) H'}. The discussion above implies that the 
inequality Pv(Tl"(U, L)) > 1/3 - l/(3 2 - 1/(3 holds. By the arguments above, at least half of the 
histories in 1Z"(U, L) are deterministic for one of the players. Without loss of generality, let it be player 
1 (Alice). With probability at least 1/2 • (1/3 — l/(3 2 — 1/(3), Alice would have made a choice of U 
by the end of round b, if she had taken an action. With probability 1 — 1/(3 she will take an action, 
and therefore Bob can play a 2 ' and will gain an expected utility (1 - 4/ '(3) ■ 1/2 • (1/3 - l/(3 2 - 1/(3). 
We can choose (3 such that the expected gain is at least 1/10. Thus, a' is not a (1/10) -equilibrium. By 
multiplying all utilities in T by lOe, we get a game T e such that T e d has a (l,0)-robust equilibrium that 
has no e-implementation. □ 

We now prove Theorem 7 by generalizing this result to arbitrary k and t. 

Theorem 7. Ifk + 2t<n< 2(k + t) there exist a game V, an e > 0, a mediator game T c i extending 
r, a strong (k, t)-robust equilibrium a ofTj, and a(k + t)-punishment strategy p with respect to a such 
that there is no strategy a CT that is an e—(k, t)-robust implementation of a in the cheap-talk extension 
ofT, even with broadcast channels. 

Proof. Divide the players into three disjoint groups: group Ai and A 2 have each have n — (k + t) 
members, and group B has 2k + 2t — n members. It is immediate that this can be done, since 2(n — 
(k - t)) + 2k + 2t - n = n. Moreover, \A\ U B\ = \A 2 U B\ = k + t. Note that neither A 1 nor A 2 is 
empty; however, B may not have any members. 

Players do not get any input (i.e., there is only one type). Intuitively, a player must output a value 
in field F, with \F\ > 6, signed by a check vector. More precisely, a player i £ Ai U A 2 outputs 
8(n — 1) + 2 elements of F, and optionally either U or D if i £ Ai or L or R if i £ A 2 . The 
first two elements of F output by i are denoted an and a{ 2 . We think of these as i's share of two 
different secrets. The remaining 8(n — 1) elements of F consist of n — 1 tuples of 8 elements, denoted 
(yiij,y2ij,hji,b 2 ji,hjij,ciji,c 2 ji,C3ji). We have one such tuple for each player j / i. We require 
that neither biji nor b 2 ji is 0. A player i in group B must output 3 + 9(n — 1) numbers, denoted 
a hi, Vhiji bhjii Chji, for /i = 1,2,3 and for each player j ^ i (again, we require that b^ji ^ 0); together 
with an optional element, which can be any of U , D, L, or R. For each player j ^ i, we would like to 
have 

o-hi + Uhijbhij = Chij, (1) 

for h = 1, 2; if i G B, then we also would like to have 03, + yujbuj = c 3«j- Note that the field elements 
a hi and yhij are output by player i, while buj and Chij are output by player j. As we said, we think of the 
values dhi to be shares of some secret. Thus, we would like there to be a function fi which interpolates 
the values an; fi(0) is intended to encode an action in {U, D} for the players in Ai to play. That is, 
if /i(0) = 0, then the players in Ai should play U; if /i(0) = 1, then they should play D.) Similarly 
we would like there to be a function f 2 that encodes an action in {L, R} for the players in A 2 to play. 
Finally, the values should encode a pair of values in {U, D} x {L, R}, where (U, L) is encoded by 
0, (U, R) by 1, (D, L) by 2, and (D, R) by 3. 
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The payoffs are determined as follows, where we take a player to be reliable if there exists a set N' 
ofn — l — t agents j ^ i such that Eq. (1) holds for k = 1 and k = 2, and for k = 3 if % G B. 

• If more than t players are unreliable, then all players get 0. 

• If all the players in group Ai U B play the same optional value and some are unreliable, then all 
players get 0. 

• If t or fewer players are unreliable, but either (a) there does not exist a unique polynomial f\ 
of degree k + t — 1 that interpolates the values an sent by the reliable players in i G A\ U B 
such that /i(0) G {0, 1}; (b) there does not exist a unique polynomial f 2 of degree k + t — 1 
that interpolates the values an sent by reliable players i in group A2 and the values a2i sent by 
reliable players in group B such that f 2 (i) G {0, 1}; (c) (/i(0), /2(C))) encodes (D, i?); or (d) 
there does not exist a unique polynomial f% of degree k + t — 1 that interpolates the values a2i 
sent by reliable players i £ AiU A2 and the values sent by reliable players % G B such that 
/3(0) encodes (/i(0), /2(0)), in the sense described above, then all players get 8/3; 

• if (a), (b), (c), and (d) above all do not hold, then suppose that g(0) encodes (x, y). Let o\ be x 
unless everyone in A\ U B plays x' as their optional value, where x' G {U, D}, in which case 
o\ = x' . Similarly, let 02 be y unless everyone in groups A2U B plays y' as their optional value, 
where y G {L,R}, in which case y 1 = 02. Let (pi,p2) be the payoff according to (01,02), as 
described in Figure 2. Then everyone in group Ai gets pi, for i = 1,2. Payoffs for players in 
B are determined as follows: if everyone in A\ U B played x' G {U, D} as their optional value, 
then players in B gets p\\ if everyone in A2 U 5 played y' G {L, f?} as their optional value, then 
everyone in B gets p 2 \ otherwise, everyone in B gets 8/3. 

The mediator chooses an output (01, 02) according to the distribution described in Figure 2. The 
mediator then encodes Oj as the secret of a degree k + t — 1 polynomial fi\ that is, Oj = /i(0) and 
encodes (01,02) as the secret of a degree k + t polynomial g. Suppose players 1, . . . n — {k + t) are in 
group Ai; players n— (fe+i)+l, . . . , 2(n— are in group A2, and players 2{n— (k+t))+l, . . . , n 
are in group B. The mediator sends each player j in group Ai (fi(j), g(j)), for i = 1, 2, and sends each 
player j in group 1? (f\(j), f2(j), g{j))- In addition, the mediator sends all players consistent check 
vectors such that ai{i) + yujbuj = cuj, a 2 (i) + y2ijb 2 ij = c 2 ij and a 3 (i) + ysijhij = c 3ij for all 
i, j G iV. If the players play the message sent by the mediator (and do not play the optional value), then 
they get expected payoff 8/3. 

We now show that this strategy is (k, t) robust. For t-immunity, note that the t players cannot take 
over all of A4 U B for i = 1 or i = 2 (since both of these sets have cardinality k + t), so they cannot 
take advantage of sending the optional element of {U, D, L, R}. If any of the t players are shown to be 
unreliable, it is easy to see that this cannot hurt the other players, since there will not be more than t 
unreliable players. If the reliable players do not send values that pass checks (a), (b), (c), and (d) above, 
then each player gets 8/3, which is the expected payoff of playing the recommended strategy. Finally, 
if a large enough subset of the t players manage to guess the check vectors and send values that satisfy 
(a), (b), (c), and (d) above, because they do not know any of the secrets, they are effectively making a 
random change to the output, so the expected payoff is still 8/3. 

For (k, t) robustness, note that a set of k + t that consist of all of Ai U B for i = 1 or % = 2 can 
change the output by all playing the same optional value, but they cannot improve their payoff this way, 
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since we have a correlated equilibrium in the 2-player game. If all k + t players are in group A\ U B, 
and their value is U, they can try to change the outcome to (D, L) by all playing D and guessing shares 
and check values in the hope of changing them to the (D, L) outcome. But if they are caught, they will 
all get 0. Since |F| > 6, the probability of getting caught is greater than 1/4, so they do not gain by 
deviating in this way. 

Note that if n > k + 2t, then if n — {k + 1) players deliberately do not play the values sent them by 
the mediator, then this is a (k + i)-punishment strategy with respect to a, since n — (k + t) > t. 

Finally, the same argument as in the 2-player game shows that, by taking over either A\ U B or 
A2 U B, a set of size k + 1 can improve their outcome by deviating. □ 

A.6 Proof of Theorem 8 

Theorem 8. If max(2, k + 1) < n < k + 3t, then there is a game V, a strong (k, t)-robust equilibrium 
a of a game with a mediator d that extends V for which there does not exist a strategy <Tct in the 
CT game that extends V such that ct C t is an e—(k,t) -robust implementation of a even if players are 
computationally bounded and we assume cryptography. 

Proof. We consider a relaxation of Byzantine agreement that we call the (A;, t)-partial broadcast prob- 
lem. There are n processes and process 1 is designated as leader. The leader has an initial value or 
1. Each process must decide on a value in {0, 1, PASS}. An execution of a protocol P is successful for 
(k, t)-partial broadcast if the following two conditions hold: 

I. (Agreement): If there are t or fewer Byzantine processes and the leader is non-Byzantine then all 

non-Byzantine processes decide on the leader's value. 
II. (No disagreement): If there are k + t or fewer Byzantine processes, then there do not exist two 
non-Byzantine processes such that one decides and the other decides 1. 

Note that if the leader is faulty, it is acceptable that some non-Byzantine processes decide on a 
common value v G {0, 1} and all other non-Byzantine processes decide PASS. Observe that the (0, t)- 
partial broadcast problem is a relaxation of the well-known Byzantine generals problem [LSP82]. We 
provide probabilistic lower bounds for this problem, which also imply known probabilistic lower bounds 
for the Byzantine generals problem. 

Proposition 7. 7/'max(2, k + t)<n<k + 3t and each input for the leader is equally likely. Then 
there exists a function ^ that maps protocols to protocols such that for all joint protocols P, there exists 
a set T of processes such that either 

(a) \T\ < t, 1 ^ T and the execution (P/v-T; ^{P)t) fails the agreement property with probability 
at least 1/6; or 

(b) \T\ < k + t, 1 G T and the execution (Pjv-T 5 ^(P)t) fails the no-disagreement property with 
probability at least 1/6. 

The running time of^{P) is polynomial in the number of players and the running time of P. 
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Proof. Partition the n players into 3 nonempty sets Bq, B\, and Bi such that \Bq\ < t, \B±\ < k + t, 
and |i?2 1 < t. Assume that B\ contains process 1 (the leader). Consider the scenario consisting of 
2n processes partitioned into six sets A§ , A\ , . . . , such that the processes of Ai have the indexes 
of the processes of B^ ( mod 3 ) ; messages sent by processes in Ai according to P reach the appropriate 
recipients in A$_i ( mod 6 ), Ai, A i+1 ( mo d6)- F° r example, if a processes i G Ai has index j & N 
and is supposed to send a messages to a processes with index j' G N such that j' G B v ( mod 3 ) and 
i! G {i — 1, i, i + 1} then this message will reach the process £' G Aj/ whose index is j'; the process 
with index 1 (the leader) starts with initial value 1 in A\ with with initial value in A4. 

Any two consecutive sets Ai, A i+1 ( mod 6 ) define a possible scenario denoted Si, where the non- 
faulty processes, Ai U A i+1 ( mod 6 ), execute P, and the faulty processes simulate the execution of all 
the 4 remaining sets of processes. For i G {0, 1, 3, 4}, let denote the probability that protocol P fails 
the agreement condition in scenario Si; for i G {2, 5} let ej denote the probability that protocol P fails 
the no-disagreement condition in scenario Si. 

We claim that e2 > 1 — (ei + 63). Indeed with probability 1 — e\ processes in A2 succeed in 
Si which implies that processes in A2 must decide 1 in this case. Similarly, with probability 1 — 
processes in ^3 must decide due to S3, hence in S2, the non-faulty processes must reach disagreement 
with probability at least 1 — (ei + 63). A symmetric argument gives es > 1 — (e^ + eo). 

Therefore it cannot be the case that for all i G {0, 1, 2}, e« + ej+3 < 2/3. Let i be an index such 
that ei + ej+3 > 2/3 and consider the set B i _ 1 ( mod 3 ) of processes that are Byzantine and simulate 4 
sets of processers according to scenario Si or S i+3 ( mod 6 ) with uniform probability. 

Given that a + e i+s ( mod 6 ) > 2 /3 then the expected probability of failure is 1/3 if the faulty players 
know the initial value. Since they can guess the initial value, the faulty players in B i ^ 1 ( mod 3 ) will cause 
P to fail with probability at least 1/6. If % = 1 then \Bi\ < t + k, 1 G Bi and the no-disagreement 
condition fails, and if i G {0, 2} then \Bi\ < t, 1 ^ Bi and the agreement condition fails. □ 

We now construct a game that captures the (k, impartial broadcast problem. Given k and t, consider 
the following game T with n players. Player 1 is the broadcaster and has two possible types, or 1, 
both equally likely. Each player must choose a characteristic G or B and output a value in {0, 1, PASS}. 
Let M > 6 + 6e. We define the utility function u as follows. 

• If player 1 (the broadcaster) has type v, then 

- if there exists a set S of at least n — t players such that all players in S choose G and output 
v , and the broadcaster chooses G, then the broadcaster gets 1 ; 

- if there does not exist a set R of at least n — t players and a value v' G {0,1} such that all 
players in R choose characteristic G and output a value in {v 1 , PASS}, and the broadcaster 
chooses characteristic B, then the broadcaster gets M; 

- in all other cases, the broadcaster gets 0. 

• Utility for player i / 1 : 

- if there exists a set R of at least n — (k + t) players and a value v 1 G {0, 1} such that all 
players in R choose G and all players in R output a value in {v' , PASS}, then player i gets 1 
if he chooses G and outputs a value in {v', PASS} and gets otherwise; 

- in all other cases, if % chooses B he gets M and if he chooses G he gets 0. 
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Consider a mediator that receives a value from the broadcaster and sends this value to all players. It 
is easy to see that the strategy a where the broadcaster truthfully tells the mediator his type and chooses 
characteristic G, and all other players choose characteristic G and output the value sent by the mediator, 
is a (k, t)-robust equilibrium whose payoff is 1 for all players. 

We claim that we cannot e-implement this mediator using cheap talk if n < k + 3t. Suppose, by 
way of contradiction, that there exists a strategy a' in r CT that e-implements a. Much as in the proof of 
Theorem 3, we can transform a' into a protocol P for the (k, impartial broadcast problem: take Pi to 
be the strategy where process i sends messages according to a\, taking its initial value to be its type if 
i = 1, and decides on the value output by a[. 

Viewing P as a protocol for the {k, t) -partial broadcast problem, let T be the set of processes guaran- 
teed to exist by Proposition 7. If \T\ < t, 1 ^ T and the execution (P/v-Tj ^(P)t) fails the agreement 
condition with probability at least 1/3, then it is easy to see that a' is not e-i-immune. Otherwise, 
if |T| < k + t, 1 G T and the execution (P/v-T, ^(P)t) fails the no-disagreement condition with 
probability at least 1/6, then it is easy to see that in T, deviating to ^f(P) and choosing B gives the 
members of T an expected utility greater than M/6 = 1 + e, contradicting the assumption the a' is 
e — (k, t) -robust. □ 



A.7 Proof of Theorem 9 

Theorem 9. Ifk + t < n < 2{k + t) and k > 1, then there exists a game V, a mediator game Yd that 
extends T, a strategy a in Tj, and a strategy p in V such that 

(a) for all e and b, there exists a utility function u b,e such that a is a (k,t) robust equilibrium in 
T d(u b ' e ) for all b and e, pisa (k, t) -punishment strategy with respect to a in T(u b,e ) ifn > k-\-2t, 
and there does not exist an e—(k, t)-robust implementation of a that runs in expected time b in the 
cheap-talk extension T C j(u b,e ) ofT(u b,e ), 

(b) there exists a utility function u such that a is a (k, t) robust equilibrium in Td{u) and, for all b, 
there exists e such that there does not exist an e—(k, t)-robust implementation of a' 1 that runs in 
expected time b in the cheap-talk extension Tct(u) ofT{u). 

This is true even if players are computationally bounded, we assume cryptography and there are broad- 
cast channels. 

Proof. First assume that k = 1, t = 0, and n = 2. Consider a 2-person secret-sharing game T with the 
secret taken from the field F = {0, . . . , 6}, and the shares are signed using check vectors. Specifically, 
nature uniformly chooses a secret s G F and a degree 2 polynomial / over F such that /(0) = s and 
all remaining coefficients are uniformly random. Nature also chooses for i G {1,2}, check vectors: yi 
uniformly in F, bi uniformly in F \ {0} and q such that f(i) + yibi = Cj. Let i = 3 — i; thus, i is the 
player other than i. 

Player i G {1,2} gets as input (f(i),yi, bj, q) and must guess the secret. Let uf^' 5 be the following 
utility function for player i G {1,2}: If player i gets the right answer (i.e., guesses the secret) and i does 
not, then i gets M; if both get the right answer, then i gets 1; if i gets the right answer and i does not, 
then i gets — M + 2 — 25; finally, if neither get the right answer, then i gets 1 — 5. 

Consider the following mediator. It expects to receive from each player i 4 field values: a share cij, 
a signature y», and two verification values q, q. If any player does not send 4 values then the mediator 
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chooses a value in F at random, and sends that to both players. Otherwise the mediator interpolates the 
degree 1 polynomial / from the shares a± and 02. Then it checks that ai + y%bi = a for i G {1,2}. If 
both checks are successful, he sends /(0) to both players, otherwise he sends both a value in F\ {/(0)} 
chosen uniformly at random. 

Consider the truthful strategy a in the mediator game: players tell the mediator the truth, and the 
mediator reports the secret. The strategy profile a gives both players utility 1 for all utility function u M ' S . 
Truthfulness is easily seen to be a 1-robust strategy in the mediator game (i.e., a Nash equilibrium). If a 
player i lies and % tells the truth, then with probability 6/7, % will be caught. In this case, i will definitely 
play the wrong value. (Note that i will play the right value if /(0) is sent, since i will be able to calculate 
what the true secret should have been, given his lie; his calculation will be incorrect if a value other than 
/(0) is sent, which is what happens if i's lie is detected.) On the other hand, i will play the right value 
with probability 1/6. Thus, i's expected utility if he is caught is 5(1 — S)/6 + (— M + 2 — 2<5)/6 = 
(7 — 75 — M)/6. If player i is not caught, then his utility is M. Thus, cheating has expected utility 
1 — 5, so i does not gain by lying as long as 5 > 0. 

Moreover, it is easy to see that, if 5 > and i chooses a value at random, then if player i chooses the 
same value, his expected utility is 1/7 + 6/7(1 — 5) = 1 — 65/7; if player i chooses a different value, 
then his expected utility is M/7 + (-M + 2 - 2<5)/7 + (1 - 5) (5/7) = 1 - 6; it follows that player I's 
expected utility is at most 1 — 65/7. Thus, if 5 > 0, then choosing a value at random is a 1-punishment 
strategy with respect to a in T(um,s) (even if the other player knows what value is chosen). 

For part (a), fix e > and 6. We show that there is no cheap-talk strategy a C j that e-implements 
a and has expected running time b in T C t(u m,€ ) if M > (1 — e) + 286e/3. Suppose, by way of 
contradiction, that there exists such a cheap-talk strategy <t ct . The key idea is to consider the expected 
probability that a player will be able to guess the correct answer at any round, assuming that both players 
use <Tct- With no information, the probability that i guesses the right answer is 1/7 and all values are 
equally likely. When the strategy terminates, the probability must be 1 (because we assume that both 
players will know the right answer at the end if they follow the recommended strategy). In general, at 
round j, player % has acquired some information P. (What P is may depend on the outcome of coin 
tosses, of course.) There is a well-defined probability of guessing the right answer given P. Thus, the 
expected probability of player i guessing the right answer after round j is the sum, taken over all the 
possible pieces of information P that i could have at the end of round j, of the probability of getting 
information P times the probability of guessing the right answer given P. By Markov's inequality, 
both players terminate by round 2b with probability at least 1/2, the expected probability of guessing 
the right answer by round 2b must be at least 4/7 for both players. (Since if an execution terminates, 
he can guess the right answer with probability 1 ; otherwise, he can guess it with probability at least 
1/7.) Thus, for each player i, there must be a round b' < b such that the expected probability of player 
i getting the right answer increases by at least 3/76 between round b' and b' + 1. It follows that there 
must be some round b' < b such that either the expected probability of player 1 guessing the answer 
after round b' + 1 is at least 3/146 more than that of player 2 guessing the answer at round after round 
6', or the expected probability player 2 guessing the answer after round 6' + 1 is at least 3/326 more 
than that of player 1 guess the answer after round 6'. (Proof: Consider a round 6' such that player l's 
expected probability of guessing the right answer increases by at least 3/76. If player 2's probability of 
guessing the right answer is at least 3/146 more than that of player 1 at round 6', then clearly player 2's 
probability of guessing the right answer at round b' is at least 3/146 more than player l's probability 
of guessing the right answer at 6' — 1 ; otherwise, player 1 's probability of guessing the right answer at 
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round 6' + 1 is at least 3/146 more than player 2's probability of guessing it at round b' .) 

Suppose, without loss of generality, that b' is such that player l's probability of guessing the right 
answer at round b' + 1 is at least 3/146 more than player 2's probability of guessing the right answer 
at round b' . Then player 1 deviates from <j C t by not sending any messages to player 2 at round 6', 
and then making a decision based on his information at round 6' + 1, using his best guess based on 
his information. (Note that player 2 will still send player 1 a message at round 6' according to a C j-) 
The best player 2 can do is to use his round b' information. If a±, 02, 03, and C14 are the probabilities 
of player 1 getting the right answer and player 2 not, both getting the right answer, 2 getting the right 
answer and 1 not, and neither getting the right answer, we must have «i — «3 > 3/146. Moreover, 
since ct C t is an e-implementation of a, by assumption, the expected utility of player 1 if he deviates is 
at least (1 - e)(l - (cci - a 3 )) + M(a 1 - a 3 ). It easily follows that, since M > (1 - e) + 286e/3, 
then l's expected utility by deviating at round b' is greater than 1 + e. Hence, a is not an e-equilibrium 
mT CT (u M ^). 

For part (b), consider the utility function u 2,0 . Note that there is no 1-punishment strategy T C t(u 2 ' ) 
with respect to a. We show that, for all 6, there is no cheap-talk strategy a C i that e-implements a and has 
expected running time 6 in T C t(u 2,0 ) if e < 3/146. Suppose that ct C t is a cheap-talk that e-implements 
a and has expected running time 6. The argument above shows that there must be a round b' where one 
of player 1 or player 2 can deviate and have expected utility at least (1 — [a\ — 03)) + 2{a\ — 03) = 
1 + (cti — Q3) > 1 + 3/146. The result immediately follows. 

For the general argument, we do the proof of part (a) here; the modifications needed to deal with 
part (b) are straightforward. Consider a k + t + 1 out of n secret sharing game, where the initial shares 
are "signed" using check vectors. Specifically, for each share f(i) and for each player j G N\i, player 
i is given a uniformly random value yij in F and player j is given a uniformly random value bij in 
F \ {0} and a value aj such that f(i) + y-ijbij = Cij. In the underlying game, players can either choose 
a value in the field (intuitively, their best guess as to the secret) or play DETECT. The utility functions 
are defined as follows: 

• if at least n — t players play DETECT, then all players playing DETECT get 1, and all others get 0; 

• if fewer than n — t players play DETECT and at least n — (k + t) but fewer than n — t players play 
the secret, then the players playing the secret get M and the other players get —M + 2 — 25 

• if fewer than n — t players play DETECT and either n — t or more players or fewer than n — (k + 1) 
players play the secret, then the players playing the secret get 1, and the remaining players get 
1-5. 

In the mediator game, each player is supposed to send the mediator his type (share, signatures, and 
verifications). The mediator checks that all the shares sent pass the checks. Note that each share can 
be subjected to n checks, one for each player. A share is reliable if it passes at least n — t checks. If 
there are not at least n — t reliable shares, but a unique polynomial / can be interpolated through the 
shares that are sent, then the mediator sends a random value that is not /(0) to all the players; otherwise, 
the mediator chooses a value in F at random and sends it to all the players. If there are at least n — t 
reliable shares, the mediator checks if a unique polynomial of degree k + t can be interpolated through 
the shares. If so, the mediator sends the secret to all the players; if not, the mediator sends DETECT to 
all the players. Let a be the strategy for the players where they truthfully tell the mediator their type, 
and play what the mediator sends. 
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We claim that playing 1 is a (k + t) -punishment strategy with respect to a if 5 > and n > k + 2t, 
and that a is a (A;, i)-robust equilibrium. The argument that playing 1 is a (A; + t)-punishment strategy 
is essentially identical to the argument for the 2-player game. However, note that if n < k + 2t, then 
t > n — (k + t). If at most t players play 1, this is not a punishment strategy since the remaining n — t 
players can play DETECT and guarantee themselves a payoff of 1. 

To show that a is a (k, i)-robust equilibrium, we first show it is t-immune. Suppose that a subset T 
of at most t players attempt to fool the mediator by guessing shares and appropriate check values, and 
the remaining players play a. Then at least n — t shares will be reliable. Note that n — t > k + t + 1. 
Either the mediator can interpolate a unique polynomial / of degree k + t through the reliable shares or 
not. In the former case, the good players will learn the secret; in the latter case, the good players will 
play DETECT. In either case, their payoff is 1. Thus, a is i-immune. 

For robustness, suppose that a set T up to k + t players deviate from the recommended strategy. If 
the true polynomial is /, the players in T can convince the mediator that some polynomial /' / / is 
the true polynomial, and the players in T know (k + 1) of the points on /', then, once the players in T 
learn /'(0), they will know k + t + 1 points on /', and hence will be able to compute /'. They can then 
compute the shares of all the other players, and thus compute /(0). This can happen only if \T\ = k + t, 
2(k + 1) — n of the players in T send their true shares (and the correct check vectors), and the remaining 
players in T send incorrect shares. So we assume that \T\ = k + t, and n — (k + t) players in T send 
incorrect values. If the mediator cannot interpolate a unique polynomial through the values sent, then 
the mediator chooses a value in F at random and sends it to all the players. Even if the players in T 
know that this is what happened, the players not in T are playing a punishment strategy, so a player in 
T cannot get expected utility higher than 1 — 65/7, even if they know that the mediator is sending a 
random value. If the mediator can interpolate a unique polynomial / through the shares sent, then the 
mediator will send /(0) if all of the n — (k + t) shares received are reliable, and a value different from 
/(0) otherwise. In the former case, which occurs with probability l/7 n ~( fc+t ), the players in T can 
compute the true secret, and will get a payoff of M. In the latter case, they compute the wrong value. 
With probability (1/6)(1 — \/7 n ~( k+t )), the other players get the right value and the players in T get a 
payoff of — M + 2 — 25; otherwise, they get a payoff of 1. It is easy to see that the expected utility of 
the players in T is at most 1 — 25/7, so the rational players will not deviate. 

Suppose that this mediator strategy can be implemented using cheap talk. We claim that, as in 
the proof of Theorem 7, we can use the implementation to give a cheap-talk implementation in the 2- 
player game. We simply divide the players into three groups: groups A and B both have n — (k + t) 
members; group K has the remaining 2{k + t) — n players (group K may be empty). Notice that 
\A U B\ = | AU K\ = k + t. Just as in the 2-player case, we can show that there must be a round b' such 
that if the players in group A pool their information together, the probability of them guessing the right 
answer at round b' + 1 is at least 3 / 14b more than the probability of the players in group B guessing the 
answer after round b' even if the players in group B pool their knowledge together, or the same situation 
holds with the roles of A and B reversed. Assume that A is the group that has the higher probability of 
guessing the right answer at time b'. Then we assume that the players in A U K deviate by not sending 
a round b' message to the players in B. (Here we use the fact that \A U B\ < k + t.) Now the argument 
continues as in the 2-player case. □ 
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